1. A computing system for detecting anomalous metrics data representing activity over a data network, the computing system comprising: a non-transitory computer-readable medium storing a metrics dataset comprising data items whose metrics values indicate data network activity, wherein the metrics dataset includes segments, wherein each segment comprises a respective subset of the data items having a common feature with respect to computing devices or users of the computing devices involved in the data network activity; a processing device communicatively coupled to the non-transitory computer-readable medium and configured to access the metrics data set and to execute program code stored in the non-transitory computer-readable medium or another non-transitory computer-readable medium, wherein, when executed by the processing device, the program code configures the processing device to perform operations comprising: identifying anomalous segments in the metrics dataset based on each anomalous segment having a respective segment trend that is different from a trend for the metrics dataset, generating a data graph comprising nodes and edges, wherein each node represents a respective one of the anomalous segments and is connected to the other nodes of the data graph via a respective subset of the edges, applying respective weights to the edges, wherein each weight applied to a respective edge between a respective pair of nodes indicates (i) a respective similarity between a respective pair of anomalous segments represented by the nodes and (ii) a respective relationship between the respective pair of anomalous segments and the metrics dataset, ranking the anomalous segments based on the weights applied to the edges, and selecting one of the anomalous segment having a rank that is greater than a threshold rank.