A computer system includes a server device which provides one or more content packages each comprising a plurality of asset files. A client device stores the content packages, and generates a virtual environment based on the asset files to be displayed on a display unit. A tracker is arranged to record an asset list directly or indirectly representing a sequence of the asset files according to progress through the virtual environment at the client device, and to distinguish between legitimate and non-legitimate behavior of the client device according to the recorded asset list.