1. A computer-implemented method for analyzing network activity, comprising: receiving a collection of access event items from a computer network, each access event item pertaining to a connection made in the computer network between a first entity and a second entity; identifying, based on input from a user, an accepted type of access event item within the collection of access event items, using a combination of feature-based analysis and graph-based analysis; removing instances of the accepted type of access event item from further consideration by the user; and repeating said identifying and removing at least one time, said identifying, removing, and repeating revealing at least one potentially unacceptable access event item in the collection of access event items, if said at least one potentially unacceptable access event item is present.