1. A computer implemented method, comprising: generating, by one or more computers, a network map comprising at least a plurality of network nodes and a plurality of edges that each indicate a communications path between two nodes from the plurality of network nodes; obtaining, by at least one of the one or more computers, network node information comprising an indication of a node type for each of the plurality of network nodes and network activity data indicating typical network activity for each of the node types; obtaining, by at least one of the one or more computers, first data indicating network activity over the edges and between the plurality of network nodes for a first time period; generating, by at least one of the one or more computers, a model of expected network activity over the edges and between the plurality of network nodes for a future time period using the network map, the network node information, and the first data; obtaining, by at least one of the one or more computers, second data indicating network activity over the edges and between the plurality of network nodes for a second time period; determining, by at least one of the one or more computers and for a particular network node from the plurality of network nodes, an edge anomaly score for each of the edges between the particular network node and the other network nodes in the plurality of network nodes that have communications paths with the particular network node using a comparison between the second data and the model of expected network activity, each of the edge anomaly scores representing a probability that the corresponding edge connected to the particular network node is anomalous; and aggregating, by at least one of the one or more computers, the edge anomaly scores for each edge connected to the particular network node to determine a node anomaly score for the particular network node.