1. A computer-implemented method, comprising: determining, by a computing system, historical parameters of a network to determine normal activity levels; enumerating, by the computing system, a plurality of paths in the network as part of a graph representing the network, wherein each computing system in the network comprises a node in the graph and the sequence of connections between two computing systems comprise a directed edge in the graph; applying, by the computing system, a Markov edge resolution model to the plurality of paths in the graph on a sliding window basis; and detecting, by the computing system, anomalous behavior based on the applied Markov edge resolution model.