A computer-implemented method comprising: obtaining user behavior data representing behavior of a user in a subject system, wherein the user behavior data indicates one or more resources accessed by the user in the subject system and, for each resource accessed by the user, when the resource was accessed; generating test data from the user behavior data, the test data comprising a first representation of resources accessed by the user during a test time period; generating training data from the user behavior data, the training data comprising respective second representations of resources accessed by the user in each of multiple time periods prior to the test time period; determining one or more other users in the subject system that accessed at least a threshold number of resources in common with the user during the time periods represented by the training data; designating the one or more other users as peers of the user in the subject system; generating an initial path graph from the training data, representing how the user navigated to the one or more resources in the subject system in each of multiple time periods prior to the test time period, wherein the initial path graph comprises nodes (510, 520, 522, 530) that represent resources accessed by the user in the subject system during a plurality of time periods represented by the training data, and links between one or more pairs of the nodes (510, 520, 522, 530), wherein each link between each pair of the nodes (510, 520, 522, 530) represents that the user accessed a first resource represented by a first node of the pair from a second resource represented by a second node of the pair; wherein generating the initial path graph also comprises generating the initial path graph from training data of the user and training data of one or more peers of the user in the subject system; generating a test path graph from the test data, representing how the user navigated to the one or more resources in the subject system during the test time period, wherein the test path graph comprises the nodes (540, 542) that represent resources accessed by the user in the subject system during the test time period, and links between one or more pairs of the nodes, wherein each link between each pair of the nodes represents that the user accessed a first resource represented by a first node of the pair navigated from a second resource represented by a second node of the pair; computing a difference between the initial path graph and the test path graph; and classifying the user behavior by the user in the test time period as anomalous based on the difference between the initial path graph and the test path graph. obtaining user behavior data representing behavior of a user in a subject system, wherein the user behavior data indicates one or more resources accessed by the user in the subject system and, for each resource accessed by the user, when the resource was accessed; generating test data from the user behavior data, the test data comprising a first representation of resources accessed by the user during a test time period; generating training data from the user behavior data, the training data comprising respective second representations of resources accessed by the user in each of multiple time periods prior to the test time period; determining one or more other users in the subject system that accessed at least a threshold number of resources in common with the user during the time periods represented by the training data; designating the one or more other users as peers of the user in the subject system; generating an initial path graph from the training data, representing how the user navigated to the one or more resources in the subject system in each of multiple time periods prior to the test time period, wherein the initial path graph comprises nodes (510, 520, 522, 530) that represent resources accessed by the user in the subject system during a plurality of time periods represented by the training data, and links between one or more pairs of the nodes (510, 520, 522, 530), wherein each link between each pair of the nodes (510, 520, 522, 530) represents that the user accessed a first resource represented by a first node of the pair from a second resource represented by a second node of the pair; wherein generating the initial path graph also comprises generating the initial path graph from training data of the user and training data of one or more peers of the user in the subject system; generating a test path graph from the test data, representing how the user navigated to the one or more resources in the subject system during the test time period, wherein the test path graph comprises the nodes (540, 542) that represent resources accessed by the user in the subject system during the test time period, and links between one or more pairs of the nodes, wherein each link between each pair of the nodes represents that the user accessed a first resource represented by a first node of the pair navigated from a second resource represented by a second node of the pair; computing a difference between the initial path graph and the test path graph; and classifying the user behavior by the user in the test time period as anomalous based on the difference between the initial path graph and the test path graph.