Abstract: A method to detect anomalous behavior in a computing system begins by training a graph neural network (GNN) in an unsupervised manner by applying contrastive representation learning on sets of positive samples and negative samples derived from one or more heterogeneous graphs using meta-path sampling. Following training, a temporal graph derived from system-generated events is received. The GNN is used to embed the temporal graph into a vector representation in a vector space. The trained GNN is also used to embed a set of attack pattern graphs into corresponding vector representations in the vector space. For anomaly detection, the representation corresponding to the temporal graph is compared to the representations corresponding to the attack pattern graphs. In one embodiment, the comparison is implemented using a fuzzy pattern matching algorithm. If a fuzzy match is found, an indication that the temporal graph is associated with a potential attack on the computing system is then output.