1. A computer-implemented method, comprising: monitoring communications between network nodes coupled to each other via at least one network; mapping the communications to one or more communications graphs, wherein at least one of the one or more communication graphs is physically distributed over a plurality of network hosts; and detecting intrusion with respect to the at least one network using graph-based data mining (GDM) for a selected subgraph and the one or more communications graphs.