1. An intrusion detection system comprising one or more processors, and a memory with instructions which when executed by the one or more processors cause the one or more processors to perform a plurality of operations comprising: receiving transaction information related to one or more current transactions between a client entity and a resource server; accessing a database storing a plurality of transaction groups, wherein the transaction groups are formed based on a plurality of past transactions between a plurality of client entities and the resource server; analyzing the received transaction information with respect to information related to at least one of the plurality of transaction groups; and based on said analyzing, determining a possibility of an occurrence of an intrusion act at the resource server.