An apparatus, computer-readable medium, and computer-implemented method for detecting anomalous user behavior, including storing user activity data collected over an observation interval, the user activity data comprising a plurality of data objects and corresponding to a plurality of users, grouping a plurality of data objects into a plurality of clusters, calculating one or more outlier metrics corresponding to each cluster, calculating an irregularity score for each of one or more data objects in the plurality of data objects, generating one or more object postures for the one or more data objects, comparing each of at least one object posture in the one or more object postures with one or more previous object postures corresponding to a same user as the object posture to identify anomalous activity of one or more users in the plurality of users.