Disclosed herein is a method for use in detection of anomalous behaviour of a device of a computer system. The method is arranged to be performed by a processing system. The method comprises deriving values, m 1 ,...,m N , of a metric, M , representative of data associated with the device； modelling a distribution of the values； and determining, in accordance with the distribution of the values, the probability of observing a more extreme value of the metric than a given value, m , of the metric, wherein the probability is used to determine whether the device is behaving anomalously. Also disclosed is an equivalent computer readable medium and anomalous behaviour detection system.
