A computer implemented method for anomaly detection in a network, comprising the following operations, wherein the operations are performed by components, and wherein the components are software components executed by one or more processors and/or hardware components: - representing, by a temporal knowledge graph (G) stored in a graph database, a network including interactions between network modules with a set of entities, a set of relations, and a set of timestamps, - with each entity representing data about the network as a node in the temporal knowledge graph (G), - with at least some entities representing network modules consisting of hardware and/or software, - with at least some of the relations representing a type of interaction between network modules, and - with at least some edges between nodes representing interactions between entities that have been observed as events, with each of these edges having a timestamp, encoding when the interaction occurred, and being an instance of one of the relations, - sampling, by a temporal random walks component (TRW) in a first step , temporal random walks from the temporal knowledge graph (G) for each relation in the temporal knowledge graph (G), wherein each temporal random walk is a sequence of edges with decreasing timestamps starting with an edge for the respective relation, - transforming, in a second step , the temporal random walks into temporal logical rules (TLR), - observing, by a monitoring component, an event in the network or a different network, and - classifying, in a third step , the observed event with regard to an anomaly, using the temporal logical rules (TLR). - representing, by a temporal knowledge graph (G) stored in a graph database, a network including interactions between network modules with a set of entities, a set of relations, and a set of timestamps, - with each entity representing data about the network as a node in the temporal knowledge graph (G), - with at least some entities representing network modules consisting of hardware and/or software, - with at least some of the relations representing a type of interaction between network modules, and - with at least some edges between nodes representing interactions between entities that have been observed as events, with each of these edges having a timestamp, encoding when the interaction occurred, and being an instance of one of the relations, - with each entity representing data about the network as a node in the temporal knowledge graph (G), - with at least some entities representing network modules consisting of hardware and/or software, - with at least some of the relations representing a type of interaction between network modules, and - with at least some edges between nodes representing interactions between entities that have been observed as events, with each of these edges having a timestamp, encoding when the interaction occurred, and being an instance of one of the relations, - sampling, by a temporal random walks component (TRW) in a first step , temporal random walks from the temporal knowledge graph (G) for each relation in the temporal knowledge graph (G), wherein each temporal random walk is a sequence of edges with decreasing timestamps starting with an edge for the respective relation, - transforming, in a second step , the temporal random walks into temporal logical rules (TLR), - observing, by a monitoring component, an event in the network or a different network, and - classifying, in a third step , the observed event with regard to an anomaly, using the temporal logical rules (TLR). <EOS>