1. A computer-implemented method for analyzing network activity, comprising: receiving a plurality of labeled access event items and unlabeled access event items from a computer network, each access event item pertaining to a connection made in the computer network between a first entity and a second entity; constructing a multi-class classifier model based on the labeled access event items; predicting labels for the unlabeled access event items using the multi-class classifier model; generating scores for each access event item to identify potential anomalies using feature-based analysis and graph-based analysis; ranking the access event items using the generated scores; presenting a list of candidate problematic access event items to a user in ranked order based on the generated scores; receiving one or more labels from the user to assign to the presented access event items; removing the access event items with user assigned labels from consideration as problematic access event items; updating the ranked list of candidate problematic access event items; presenting the user with the updated list of candidate problematic access event items; and successively removing accepted access event items identified by the user from consideration to reveal at least one potentially unacceptable access event item, if the at least one potentially unacceptable access event item is present.