A computer-implemented method of detecting abnormal events in a telecommunication system can include a training phase and a production phase. The training phase can include recording data events in a log file during the execution of the system and creating a standard for the data events representing a properly working environment of the telecommunication system by applying a training procedure. The production phase can include receiving at least one new data event and determining whether the at least one new data event is a normal event that matches the standard or not. If the at least one new data event matches the standard, it can be used for updating the standard. If the at least one new data event does not match the standard, it can be classified and reported as at least one an abnormal event.