1. A method comprising: generating a set of feature profiles, each feature profile having a set of features derived from a profile constructed from an obtained set of correlated events or a set of correlated user accounts; generating hypergraphs, wherein the hypergraphs include nodes corresponding to feature profiles and edges between particular nodes representing a measure of similarity between nodes, wherein the measure of similarity between a pair of nodes is based at least in part on a comparison of a plurality of feature values associated with each node of the pair of nodes and weighting the edges based on the comparison; and analyzing the generated hypergraphs to detect abnormal graph nodes based on a comparison of the feature profiles of each node and a global feature profile.