A method for detecting anomalous network activity, comprising: receiving information indicating network activity on a network, wherein the information includes a plurality of IP addresses corresponding to a plurality of devices participating in the network activity and information relating to packets transmitted between devices (408, 410) included in the plurality of devices participating in the network activity; generating a weighted directed graph representing the network activity, wherein the weighted directed graph has a plurality of nodes and has an edge between two of the plurality of nodes, wherein each node of the graph indicates an IP address of a device (408, 410) participating in the network activity, and wherein the edge has at least three weights represented as a vector, wherein the weights include a number of connections between the two of the plurality of nodes, an average number of bytes per packet sent between the two of the plurality of nodes, and a number of ports scanned; generating a representation of the graph representing the network activity, wherein the representation of the graph representing the network activity reduces a dimensionality of information indicated in the graph representing the network activity; identifying a plurality of clusters of network activity based on the representation of the graph representing the network activity; determining that at least one cluster of the plurality of clusters corresponds to anomalous network activity; and in response to determining that the at least one cluster of the plurality of clusters corresponds to anomalous network activity, causing a network connection of at least one device included in the at least one cluster to be blocked. receiving information indicating network activity on a network, wherein the information includes a plurality of IP addresses corresponding to a plurality of devices participating in the network activity and information relating to packets transmitted between devices (408, 410) included in the plurality of devices participating in the network activity; generating a weighted directed graph representing the network activity, wherein the weighted directed graph has a plurality of nodes and has an edge between two of the plurality of nodes, wherein each node of the graph indicates an IP address of a device (408, 410) participating in the network activity, and wherein the edge has at least three weights represented as a vector, wherein the weights include a number of connections between the two of the plurality of nodes, an average number of bytes per packet sent between the two of the plurality of nodes, and a number of ports scanned; generating a representation of the graph representing the network activity, wherein the representation of the graph representing the network activity reduces a dimensionality of information indicated in the graph representing the network activity; identifying a plurality of clusters of network activity based on the representation of the graph representing the network activity; determining that at least one cluster of the plurality of clusters corresponds to anomalous network activity; and in response to determining that the at least one cluster of the plurality of clusters corresponds to anomalous network activity, causing a network connection of at least one device included in the at least one cluster to be blocked.