1. A method of synthesizing anomalous data for creating an artificial set of features reflecting anomalous behavior for a particular activity, the method comprising: selecting a feature; retrieving a plurality of normal-feature values associated with the feature; defining a first distribution of users of normal feature values; defining an expected second distribution of users of anomalous feature values; and producing a plurality of anomalous-behavior feature values for the feature.