1. A method of detecting and classifying anomalous events, comprising: receiving an input log file including a plurality of events, wherein each event comprises a data set; for each event, providing multiple contexts that group the data set into different sub-groups; generating an anomaly score for each context so that each event has at least two anomaly scores associated therewith; for each event, combining at least the anomaly scores to generate an overall event score so as to classify the event as being normal or abnormal; and outputting a plurality of the overall event scores for the input log file.