A system for monitoring accesses to resource nodes (104, 106, 310-316) in a computer network for anomalies, the system comprising: one or more computer processors; and one or more computer-readable media (904, 906, 922) storing instructions which, when executed by the one or more computer processors, cause the one or more computer processors to perform operations comprising: monitoring the computer network for access events each involving an access or attempted access by one of a plurality of accessing nodes (104, 108, 302-306) to one of a plurality of resource nodes (104, 106, 310-316); storing time-stamped records of the access events; creating and maintaining, based on the stored records, a time-dependent bipartite graph that represents the plurality of accessing nodes and the plurality of resource nodes as two distinct sets of nodes and the access events as edges between the nodes; computing time-dependent multi-dimensional graph embeddings of at least one of the plurality of accessing nodes or the plurality of resource nodes from the time-dependent bipartite graph; computing an anomaly score for a current access event based on at least one of: distances of graph embeddings of an accessing node associated with the current access event from graph embeddings of accessing nodes that previously accessed a resource node associated with the current access event, or distances of a graph embedding of the resource node associated with the current access event from graph embeddings of resource nodes previously accessed by the accessing node associated with the current access event; determining, based on comparison of the anomaly score against a specified anomaly threshold, that the current access event is anomalous; and responsive to determining that the current access event is anomalous, causing at least one mitigating action. one or more computer processors; and one or more computer-readable media (904, 906, 922) storing instructions which, when executed by the one or more computer processors, cause the one or more computer processors to perform operations comprising: monitoring the computer network for access events each involving an access or attempted access by one of a plurality of accessing nodes (104, 108, 302-306) to one of a plurality of resource nodes (104, 106, 310-316); storing time-stamped records of the access events; creating and maintaining, based on the stored records, a time-dependent bipartite graph that represents the plurality of accessing nodes and the plurality of resource nodes as two distinct sets of nodes and the access events as edges between the nodes; computing time-dependent multi-dimensional graph embeddings of at least one of the plurality of accessing nodes or the plurality of resource nodes from the time-dependent bipartite graph; computing an anomaly score for a current access event based on at least one of: distances of graph embeddings of an accessing node associated with the current access event from graph embeddings of accessing nodes that previously accessed a resource node associated with the current access event, or distances of a graph embedding of the resource node associated with the current access event from graph embeddings of resource nodes previously accessed by the accessing node associated with the current access event; determining, based on comparison of the anomaly score against a specified anomaly threshold, that the current access event is anomalous; and responsive to determining that the current access event is anomalous, causing at least one mitigating action. monitoring the computer network for access events each involving an access or attempted access by one of a plurality of accessing nodes (104, 108, 302-306) to one of a plurality of resource nodes (104, 106, 310-316); storing time-stamped records of the access events; creating and maintaining, based on the stored records, a time-dependent bipartite graph that represents the plurality of accessing nodes and the plurality of resource nodes as two distinct sets of nodes and the access events as edges between the nodes; computing time-dependent multi-dimensional graph embeddings of at least one of the plurality of accessing nodes or the plurality of resource nodes from the time-dependent bipartite graph; computing an anomaly score for a current access event based on at least one of: distances of graph embeddings of an accessing node associated with the current access event from graph embeddings of accessing nodes that previously accessed a resource node associated with the current access event, or distances of a graph embedding of the resource node associated with the current access event from graph embeddings of resource nodes previously accessed by the accessing node associated with the current access event; distances of graph embeddings of an accessing node associated with the current access event from graph embeddings of accessing nodes that previously accessed a resource node associated with the current access event, or distances of a graph embedding of the resource node associated with the current access event from graph embeddings of resource nodes previously accessed by the accessing node associated with the current access event; determining, based on comparison of the anomaly score against a specified anomaly threshold, that the current access event is anomalous; and responsive to determining that the current access event is anomalous, causing at least one mitigating action.