Provided are a method for detecting an anomaly based on behavior-analysis. The method comprises creating, by an apparatus for detecting an anomalous behavior of a user, K clusters, each cluster of the K clusters being created based on past behavior counters associated with one or more users, designating, by the apparatus, a cluster pattern of the each cluster of the K clusters, the cluster pattern indicating a representative behavior of the past behavior counters belonging to the each cluster, determining, by the apparatus, a past behavior pattern of a first user based on a first past behavior counters associated with the first user and the each cluster of the K clusters, obtaining, by the apparatus, a first current behavior counters associated with the first user based on monitoring information from an agent software program, the agent software program being installed on a computing device of the first user and monitoring behaviors associated with the first user, determining, by the apparatus, a current behavior pattern of the first user based on the first current behavior counters and the each cluster of the K clusters and detecting, by the apparatus, the anomalous behavior of the first user by comparing the past behavior pattern and the current behavior pattern of the first user.