A method and system for monitoring the behavior of at least one observable
object, e.g. a network element, of a network, wherein at least one
parameter of the observable object is repeatedly detected. An actually
detected parameter is input to a learning process and to an analyzing
process, wherein the learning process forms a reference, based on at
least two detected parameter values, for describing the behavior of the
observable object. The analyzing process compares the input parameter and
the reference for detecting an anomal behavior. The parameter preferably
is a vector which includes several values describing properties or
functioning of the observable object, and is formed based on events
and/or reports from the object.