13. A system for analyzing a collection of access event items collected from a computer network, each access event item pertaining to a connection made in the computer network between a first entity and a second entity, comprising: a general-purpose computing device; a computer program comprising an analysis module that is executable by the general-purpose computing device, the analysis module comprising: an analyst interaction module configured to provide an interface that allows a user to interact with the analysis module; and an activity classification module that uses active learning including both feature-based analysis and graph-based analysis to identify a plurality of candidate problematic access event items, generate a ranked list of the candidate problematic access event items for presentation to the user via the analyst interaction module, receive from the user one or more labels to assign to the presented access event items, remove the access event items with user assigned labels from consideration as problematic access event items, update the list of candidate problematic access event items, present the user with an updated list of candidate problematic access event items, and successively remove accepted access event items identified by the user from consideration to reveal at least one potentially unacceptable access event item, if the at least one potentially unacceptable access event item is present.
13. A system for analyzing a collection of access event items collected from a computer network, each access event item pertaining to a connection made in the computer network between a first entity and a second entity, comprising: a general-purpose computing device; a computer program comprising an analysis module that is executable by the general-purpose computing device, the analysis module comprising: an analyst interaction module configured to provide an interface that allows a user to interact with the analysis module; and an activity classification module that uses active learning including both feature-based analysis and graph-based analysis to identify a plurality of candidate problematic access event items, generate a ranked list of the candidate problematic access event items for presentation to the user via the analyst interaction module, receive from the user one or more labels to assign to the presented access event items, remove the access event items with user assigned labels from consideration as problematic access event items, update the list of candidate problematic access event items, present the user with an updated list of candidate problematic access event items, and successively remove accepted access event items identified by the user from consideration to reveal at least one potentially unacceptable access event item, if the at least one potentially unacceptable access event item is present. 15. The system of claim 13 , wherein the activity classification module comprises a feature-based analysis module configured to generate at least one anomaly score for each access event item, the anomaly score identifying an extent to which a classification of the access event item is assessed as anomalous.