A system for detecting an unknown undesirable event comprises an input device configured to receive a dataset comprising a plurality n of multidimensional datapoints (MDDPs), a processor configured to embed the MDDPs in an lower dimension embedded space to obtain embedded MDDPs, and a detection engine configured to calculate distributions of distances Dnni, i=1, . . . , n of each embedded MDDP from a plurality of nearest-neighbors (nn) to compute a threshold Dnnt and to classify a particular MDDP of the dataset or a newly arrived MDDP (NAMDDP) as an abnormal MDDP based on comparison with threshold Dnnt, wherein the classification is automatic and unsupervised without relying on a signature, rules or domain expertise and wherein the particular MDDP classified as abnormal is indicative of the unknown undesirable event.