A method for supporting detection of irregularities in a network, the method comprising: monitoring features of said network using at least one monitoring device in order to collect spatio-temporal measuring data, providing, in an off-line phase, a training matrix where collected measuring data is aggregated in a predetermined time window such that said training matrix includes spatio-temporal correlations, performing, in said off-line phase, non-negative matrix factorization in order to decompose said training matrix into a coefficient matrix and a basis matrix, wherein temporal correlations and spatial correlations are jointly considered, creating, in an on-line phase, a current runtime matrix on the basis of measuring data newly collected in the on-line phase, computing, in said on-line phase, a current runtime coefficient matrix on the basis of said current runtime matrix and said basis matrix, and comparing, in said on-line phase, said current runtime coefficient matrix with at least one coefficient matrix that was computed previously. Furthermore, a corresponding system is disclosed.