Detecting threats against computing resources based on user behavior changes

A system comprising:

• a memory storing instructions;
• and
• a processor and configured to execute the instructions to perform a process comprising:
• generating, based on log data associated with at least one user session in a network environment associated with a user, a logical graph, wherein the logical graph comprises:
• (1) a first node corresponding to the user, (2) a plurality of additional nodes, and (3) a set of edges connecting the first node to one or more of the additional nodes, wherein each edge in the set of edges represents a change in behavior of the user;
• using the logical graph to detect an anomaly, wherein detecting the anomaly includes determining that a change has been made to at least one edge included in the set of edges;
• and
• generating, in response to detecting the anomaly, an alert.

A computer program product embodied in a non-transitory computer readable storage medium and comprising computer instructions for:

• generating, based on log data associated with at least one user session in a network environment associated with a user, a logical graph, wherein the logical graph comprises:
• (1) a first node corresponding to the user, (2) a plurality of additional nodes, and (3) a set of edges connecting the first node to one or more of the additional nodes, wherein each edge in the set of edges represents a change in behavior of the user;
• using the logical graph to detect an anomaly, wherein detecting the anomaly includes determining that a change has been made to at least one edge included in the set of edges;
• and
• generating, in response to detecting the anomaly, an alert.