Modelling user behaviour in a network using computer event logs