1. A method for modeling user access to computer resources, the method comprising: collecting a first set of log records documenting user actions in accessing the computer resources during a first time interval; aggregating the first set of log records at one or more chronological levels; selecting one or more model types, wherein each model type is used to evaluate the first set of log records; selecting one or more attributes from the first set of log records; aggregating data associated with the one or more selected attributes into one or more mining tables according to the one or more levels; selecting algorithm parameters for the selected one or more model types; and creating the one or more models of user behavior by running the selected one or more model types using the aggregated data in the one or more mining tables and the selected algorithm parameters, wherein each model of user behavior characterizes an expected pattern for accessing the computer resources.