Abstract: In some examples, a system generates a graphical representation of entities associated with a computing environment, and derives features for the entities represented by the graphical representation, the features comprising neighborhood features and link-based features, a neighborhood feature for a first entity of the entities derived based on entities that are neighbors of the first entity in the graphical representation, and a link-based feature for the first entity derived based on relationships of other entities in the graphical representation with the first entity. The system determines, using a plurality of anomaly detectors based on respective features of the derived features, whether the first entity is exhibiting anomalous behavior.