1. A method comprising: detecting a plurality of events related to the activities of users within a security system wherein the events are defined by a plurality of attributes, wherein at least one attribute is categorical and wherein a data distance between events is a function of event attributes; evaluating the detected events using a density based anomaly detection method, f(r), where r is a size of a neighborhood around a data point representing the event; comparing a value of the evaluated expression with a margin threshold value (msg(r)); and setting an alarm upon detecting that the value exceeds the threshold value.