1. A computer-implemented method, comprising: monitoring communications between network nodes coupled to each other via at least one network; mapping the communications to one or more communications graphs, wherein at least one of the communication graphs is physically distributed over a plurality of mapping network hosts; computing relative frequency of discovered subgraphs representing behavior patterns within the communications graphs; and detecting indications of malicious behavior with respect to the at least one network without using signatures by identifying infrequent patterns of the behavior relative to frequent patterns of the behavior according to the relative frequency.