More and more organizations are under cyberattacks. To prevent this kind of threats, it is essential to detect them upstream by highlighting abnormal activities within networks. This paper presents our anomalies detection approach that consists of aggregating pre-processed network flows into sectors. Then for each sector, data are split into equal time periods. Finally an unsupervised clustering algorithm is employed to extract that we called activity deviations. If a specific sector network activity for one specific period differs from others, it means that a network anomaly has been detected. Our experiments are based on a real dataset provided by a French mobile operator. With our proposed method, we have been able to detect anomalies corresponding to real crowded events like fire, soccer match or concert.