1. A non-transitory computer storage medium encoded with instructions that, when executed by a one or more computers, cause the one or more computers to perform operations comprising: accessing, by one or more computers, a model of expected network activity for one or more subnets represented by a network map that includes a plurality of edges that each represent a communications path between two nodes from a plurality of network nodes, where each subnet in the one or more subnets comprises at least one network node from the plurality of network nodes and at least one edge from the plurality of edges; obtaining, by at least one of the one or more computers, one or more data packets indicating network activity over at least one of the edges and between two of the plurality of network nodes during a time period; using the model of expected network activity and the one or more data packets, determining, by at least one of the one or more computers for at least one of the one or more subnets, a subnet anomaly score that represents a probability that at least one of the one or more data packets indicating the network activity, during the time period, across an edge connected to a network node, both included in the respective subnet, is anomalous; and determining, by at least one of the one or more computers, an action using the subnet anomaly score.