In some embodiments, a processor accesses a metrics dataset, which includes metrics whose values indicate data network activity. The metrics dataset has segments. Each segment is a respective subset of the data items having a common feature. The processor identifies anomalous segments in the metrics dataset. Each anomalous segment has a segment trend that is different from a trend associated with the larger metrics dataset. The processor generates a data graph that includes nodes, which represent anomalous segments, and edges connecting the nodes. The processor applies weights to the edges. Each weight indicates (i) a similarity between a pair of anomalous segments represented by the nodes connected by the weighted edge and (ii) a relationship between the anomalous segments and the metrics dataset. The processor ranks the anomalous segments based on the applied weights and selects one or more segments with sufficiently high ranks.