1. A computer-implemented method for detecting abnormal user behavior for a query session of an electronic search engine through determining clickstream data by tracking user click activities associated with a search results page generated in response to a user search request including a search term, the method comprising: electronically determining a conformance score for the clickstream data based on existing clickstream data for one or more similar query sessions, the conformance score representing normal user behavior; normalizing the conformance score that includes a plurality of tracked user transitions to generate a normalized conformance value based on an event count for the query session; mapping the clickstream characteristics onto a probability score using univariate or multivariate models; and comparing the probability score with the probability scores for the one or more similar query sessions to determine if the query session is abnormal.