1. A computer-implemented method of synthesizing anomalous data for creating an artificial set of feature values reflecting anomalous behavior for use in training a model for computer network intrusion detection, the method comprising: selecting a feature relating to computer network usage; retrieving a plurality of normal behavior values associated with the feature; defining a first distribution of users that corresponds to the plurality of normal behavior values; defining an expected second distribution of users that corresponds to anomalous behavior; and using a computer, synthetically producing a plurality of anomalous-behavior values for the feature from the expected second distribution of users that corresponds to alternative anomalous behavior.