A network sampling based path decomposition and anomaly detection system comprising: at least one hardware processor; a master network graph generator, executed by the at least one hardware processor, to evaluate computer-generated log file data to generate a master network graph that specifies known events and transitions between the known events; a master network graph sampler, executed by the at least one hardware processor, to decompose the master network graph to generate a representative network graph that includes a reduced number of paths of the master network graph, wherein the reduced number of paths are selected with respect to probabilities of occurrence of the paths in the master network graph; a source monitor, executed by the at least one hardware processor, to monitor a source to determine a cyber security threat by receiving incoming log file data related to the source, comparing the incoming log file data related to the source to the representative network graph, and determining, based on the comparison of the incoming log file data related to the source to the representative network graph, an anomaly in the representative network graph; and an anomaly indicator, executed by the at least one hardware processor, to generate, based on the monitoring, a report indicative of the cyber security threat based on the anomaly in the representative network graph; wherein the master network graph sampler is to decompose the master network graph to generate the representative network graph that includes the reduced number of paths of the master network graph by determining a sample size, executing, based on the sample size, a depth-first search on the master network graph, retaining, based on the sample size, a predetermined number of paths that are located in the master network graph in a bucket, wherein the predetermined number of paths that are retained is equal to the sample size; determining a further path after retaining the predetermined number of paths, determining whether the further path is to be retained in the bucket, and in response to a determination that the further path is to be retained in the bucket, removing one of the retained predetermined number of paths from the bucket, and retaining, in place of the removed one of the retained predetermined number of paths, the further path in the bucket. at least one hardware processor; a master network graph generator, executed by the at least one hardware processor, to evaluate computer-generated log file data to generate a master network graph that specifies known events and transitions between the known events; a master network graph sampler, executed by the at least one hardware processor, to decompose the master network graph to generate a representative network graph that includes a reduced number of paths of the master network graph, wherein the reduced number of paths are selected with respect to probabilities of occurrence of the paths in the master network graph; a source monitor, executed by the at least one hardware processor, to monitor a source to determine a cyber security threat by receiving incoming log file data related to the source, comparing the incoming log file data related to the source to the representative network graph, and determining, based on the comparison of the incoming log file data related to the source to the representative network graph, an anomaly in the representative network graph; and receiving incoming log file data related to the source, comparing the incoming log file data related to the source to the representative network graph, and determining, based on the comparison of the incoming log file data related to the source to the representative network graph, an anomaly in the representative network graph; and an anomaly indicator, executed by the at least one hardware processor, to generate, based on the monitoring, a report indicative of the cyber security threat based on the anomaly in the representative network graph; wherein the master network graph sampler is to decompose the master network graph to generate the representative network graph that includes the reduced number of paths of the master network graph by determining a sample size, executing, based on the sample size, a depth-first search on the master network graph, retaining, based on the sample size, a predetermined number of paths that are located in the master network graph in a bucket, wherein the predetermined number of paths that are retained is equal to the sample size; determining a further path after retaining the predetermined number of paths, determining whether the further path is to be retained in the bucket, and in response to a determination that the further path is to be retained in the bucket, removing one of the retained predetermined number of paths from the bucket, and retaining, in place of the removed one of the retained predetermined number of paths, the further path in the bucket. removing one of the retained predetermined number of paths from the bucket, and retaining, in place of the removed one of the retained predetermined number of paths, the further path in the bucket.