1. A method comprising: receiving, by a computer system, first event data indicative of computer network activity of a plurality of users and network devices in a computer network; generating, by the computer system, classification metadata for each of the network devices and users, based on the first event data, to indicate relevance in a network security context of each of the users and network devices; identifying, by the computer system, usage relationships between one or more of the users and one or more of the network devices, based on first event data; assigning, by the computer system, usage similarity scores to the network devices based on the identified usage relationships, the usage similarity scores being indicative of which of the network devices have been used by the same or similar group of users; receiving, by the computer system, second event data indicative of computer network activity of a particular user of the plurality of users; and detecting, by the computer system and in response to the second event data, an anomaly indicative that the particular user has interacted with a particular network device with which the particular user does not normally interact, based on the usage similarity scores and the classification metadata.
1. A method comprising: receiving, by a computer system, first event data indicative of computer network activity of a plurality of users and network devices in a computer network; generating, by the computer system, classification metadata for each of the network devices and users, based on the first event data, to indicate relevance in a network security context of each of the users and network devices; identifying, by the computer system, usage relationships between one or more of the users and one or more of the network devices, based on first event data; assigning, by the computer system, usage similarity scores to the network devices based on the identified usage relationships, the usage similarity scores being indicative of which of the network devices have been used by the same or similar group of users; receiving, by the computer system, second event data indicative of computer network activity of a particular user of the plurality of users; and detecting, by the computer system and in response to the second event data, an anomaly indicative that the particular user has interacted with a particular network device with which the particular user does not normally interact, based on the usage similarity scores and the classification metadata. 14. The method of claim 1 , wherein said assigning usage similarity scores comprises: forming a bipartite graph having nodes representing the users and the network devices and edges representing the relationships between the users and the network devices; assigning an initial weight value to a node of the bipartite graph; keeping a percentage of the initial weight value at the node and equally distributing a remainder of the initial weight value from the node along edges of the node to other nodes; at each node, repeating a process until a weight value at each node converges, the process including: summing weight values at each node of the bipartite graph, and keeping the percentage of a previously distributed weight value at the node and equally distributing a remainder of the weight value from the node along edges of the node to other nodes; and assigning usage similarity scores to the network devices based on the converged weight values at the nodes representing the network devices.