A method of detecting a reference sequence of events in a sample sequence of events, wherein each event is of a certain event type and holds a set of data attributes, includes the steps of: picking candidate combinations of events from said sample sequence so that the event types within each candidate combination match the event types in the reference sequence, calculating an overall similarity score for each candidate combination from at least (i) an event occurrence score based on occurrence deviations representing a count of non-matching events between the events of a candidate combination matching events of the reference sequence and (ii) an attribute match score based on similarity deviations between the data attributes of the events of a candidate combination and the data attributes of the matching events of the reference sequence, and identifying the candidate combination with the best overall similarity score as reference sequence detected.