1. A method, for detecting anomalous information access, comprising the steps of: detecting, at a network interface, a first access request from a user; comparing, by a controller, the first access request with a baseline behavior associated with the user; issuing, by the controller, a first alert at a first predetermined level if the first access request differs from the baseline behavior; updating, by the controller, the baseline behavior with information from the first access request if the first access request is an acceptable behavior from the user; and if a second access request being received after the first access request, the second access request being identical to the first access request except for being received at a later time, issuing, by the controller, a second alert at a second predetermined level if the second access request differs from the baseline behavior, the second predetermined level being lower than the first predetermined level, wherein the behavior is not updated with the information from the first access request if the first access request is an unacceptable behavior from the user.