A system such as a Web-based system in which a plurality of computers
interact with each other is monitored to detect online an anomaly.
Transactions of a service provided by each of a plurality of computers to
another computer are collected, a matrix of correlations between nodes in
the system is calculated from the transactions, and a feature vector
representing a node activity balance is obtained from the matrix. The
feature vector is monitored using a probability model to detect a
transition to an anomalous state.