Security of server hosting remote application

A computer system for detecting a malicious activity with respect to an application hosted on a server, comprising:

• one or more processors, one or more computer-readable memories, one or more computer-readable tangible storage media, and program instructions stored on at least one of the one or more computer-readable tangible storage media for execution by at least one of the one or more processors via at least one of the one or more memories, wherein the computer system is capable of performing a method comprising:
• collecting user activity data associated with an application accessed remotely over a network, wherein the collected user activity data includes at least one set of user requests received from a user, each set of the at least one received set of user requests is associated with a corresponding location within the application;
• generating a graph from the collected user activity data, the generated graph including a plurality of nodes and a plurality of connections linking the plurality of nodes, wherein each node of the plurality of nodes represents a corresponding set of the at least one received set of user requests and each connection of the plurality of connections represents a user navigable path between a pair of corresponding locations within the application;
• storing the generated graph;
• monitoring a subsequent user activity associated with the application accessed remotely over the network;
• and
• detecting that the subsequent user activity does not match the stored graph of the collected user activity data.

A computer program product for detecting a malicious activity with respect to an application hosted on a server, comprising:

• one or more computer-readable tangible storage media and program instructions stored on at least one of the one or more computer-readable tangible storage media, the program instructions executable by a processor to cause the processor to perform a method comprising:
• collecting user activity data associated with an application accessed remotely over a network, wherein the collected user activity data includes at least one set of user requests received from a user, each set of the at least one received set of user requests is associated with a corresponding location within the application;
• generating a graph from the collected user activity data, the generated graph including a plurality of nodes and a plurality of connections linking the plurality of nodes, wherein each node of the plurality of nodes represents a corresponding set of the at least one received set of user requests and each connection of the plurality of connections represents a user navigable path between a pair of corresponding locations within the application;
• storing the generated graph;
• monitoring a subsequent user activity associated with the application accessed remotely over the network;
• and
• detecting that the subsequent user activity does not match the stored graph of the collected user activity data.