1. A computer-implemented method for transforming representations of network activity data, the method being executed by one or more processors and comprising: receiving a data structure that represents communication events between computing devices of one or more networks, wherein the data structure is a directed graph stored in a graph database; analyzing the data structure and determining a set of potential attack paths represented in the data structure; assigning a score to each potential attack path in the set of potential attack paths; removing potential attack paths from the set of potential attack paths that have scores that do not meet a predetermined threshold; ranking potential attack paths that remain in the set of potential attack paths, based on each score assigned to each potential attack path; and providing the data structure that includes a ranked set of potential attack paths.