A computer implemented method for anomaly detection in a network, comprising the following operations, wherein the operations are performed by components, and wherein the components are software components executed by one or more processors and/or hardware components: - representing, by a temporal knowledge graph stored in a graph database, a network including interactions between network modules with a set of entities, a set of relations, and a set of timestamps, - with each entity representing data about the network as a node in the temporal knowledge graph, - with at least some entities representing network modules consisting of hardware and/or software, - with at least some of the relations representing a type of interaction between network modules, and - with at least some edges between nodes representing interactions between entities that have been observed as events, with each of these edges having a timestamp, encoding when the interaction occurred, and being an instance of one of the relations, - sampling, by a temporal random walks component in a first step, temporal random walks from the temporal knowledge graph for each relation in the temporal knowledge graph, wherein each temporal random walk is a sequence of edges with decreasing timestamps starting with an edge for the respective relation, - transforming, in a second step, the temporal random walks into temporal logical rules, - observing, by a monitoring component, an event in the network or a different network, and - classifying, in a third step, the observed event with regard to an anomaly, using the temporal logical rules. - representing, by a temporal knowledge graph stored in a graph database, a network including interactions between network modules with a set of entities, a set of relations, and a set of timestamps, - with each entity representing data about the network as a node in the temporal knowledge graph, - with at least some entities representing network modules consisting of hardware and/or software, - with at least some of the relations representing a type of interaction between network modules, and - with at least some edges between nodes representing interactions between entities that have been observed as events, with each of these edges having a timestamp, encoding when the interaction occurred, and being an instance of one of the relations, - with each entity representing data about the network as a node in the temporal knowledge graph, - with at least some entities representing network modules consisting of hardware and/or software, - with at least some of the relations representing a type of interaction between network modules, and - with at least some edges between nodes representing interactions between entities that have been observed as events, with each of these edges having a timestamp, encoding when the interaction occurred, and being an instance of one of the relations, - sampling, by a temporal random walks component in a first step, temporal random walks from the temporal knowledge graph for each relation in the temporal knowledge graph, wherein each temporal random walk is a sequence of edges with decreasing timestamps starting with an edge for the respective relation, - transforming, in a second step, the temporal random walks into temporal logical rules, - observing, by a monitoring component, an event in the network or a different network, and - classifying, in a third step, the observed event with regard to an anomaly, using the temporal logical rules.