A method for detecting abnormality adapted to detect abnormal operations of an operating system is provided. The method includes: calculating a safe range of usage of the operating system during one or more time periods according to a historical data stream; calculating abnormal ratios corresponding to the one or more time periods according to a current data stream and the safe range of usage; selecting one or more abnormal time periods from the one or more time periods according to a threshold and the abnormal ratios; calculating an abnormal indicator for each of the one or more abnormal time periods according to the historical data stream and the current data stream; and ranking the one or more abnormal time periods according to the abnormal indicator(s).