1. A method, comprising: for a system or application used by a plurality of users, providing an access to a memory device storing user data samples for all users of the plurality of users; selecting a target user from among the plurality of users; and using a processor on a computer and using data samples for the target user and data samples for other users of the plurality of users, generating a normal sample data set and an abnormal (anomalous) sample data set to serve as a training data set for training a model for an anomaly detection monitor for the target user such that the data samples of the target user are used to derive a normal sample data set for the training set and the data samples of other users are used to derive an abnormal sample data set for the training set.