A computer-implemented method for constructing network activity profiles is provided, which comprises the following: obtaining a plurality of records of network activities from an activity source, each record corresponding to an interaction with a network resource via the network from the activity source, wherein each record comprises at least a network endpoint address from where the interaction originates and an indication of a time of the interaction; for each record, determining a geographical location corresponding to the network endpoint address of that record and associating the determined geographical location with that record; and constructing at least one profile for the activity source based on the plurality of records and at least one geographical location associated with the records, wherein each profile comprises a time-based behavior pattern associated with the at least one geographical location.