1. A method, for detecting anomalous information access, comprising the steps of: detecting, at a network interface, a first access request from a user; comparing, by a controller, the first access request with a baseline behavior associated with the user; issuing, by the controller, an alert at a first predetermined level if the access request differs from the baseline behavior; updating, by the controller, the baseline behavior with information from the first access request; and if a second access request being received after the first access request, the second access request being identical to the first access request except for being received at a later time, issuing, by the controller, an alert at a second predetermined level if the access request differs from the baseline behavior, the second predetermined level being lower than the first predetermined level.