1. A method, comprising: obtaining, with one or more processors, a clustered graph having more than 1,000 nodes and more than 2,000 edges, wherein: each respective edge connects a respective pair of the nodes, and each of the nodes has a plurality of respective node attributes other than an identifier of the node; obtaining, with one or more processors, a designation of a given node attribute from among the plurality of node attributes; identifying, with one or more processors, a first subset of nodes of the graph as having anomalous values of the given node attribute by comparing values of the given node attribute in the first subset to a distribution of the given node attribute; identifying, with one or more processors, a second subset of nodes of the graph as having representative values of the given node attribute by comparing values of the given node attribute in the second subset to the distribution of the given node attribute; and sending, with one or more processors, instructions to a client device to display a representation of the graph, the representation of the graph comprising: a plurality of clusters of the nodes; visual identification of at least some nodes of the first subset as being members of the first subset; and visual identification of at least some nodes of the second subset as being members of the second subset.