The present invention provides for the detection of abnormal user behavior for a query session of an electronic search engine. A query session is initiated upon receipt of a user search request that includes one or more search terms. The search engine, in accordance with known search technology, generates a search results page that includes various hyperlinks, including for example web content hyperlinks, page navigation hyperlinks and advertising hyperlinks. Tracking user activities generates the clickstream associated with the search results page. The present invention determines a probability score for the clickstream and then this score is normalized. A comparison of the normalized probability score with other normalized probability scores for similar query sessions determines of the normalcy of the query session.