A system, method, and computer-readable medium for determining risk associated with anomalous behavior of a user on a computer network including receiving anomalous behavioral data corresponding to anomalous activity of the user on the computer network, determining surprisal values corresponding to one or more behavioral factors based on one or more of: one or more probabilities corresponding to one or more current values or one or more characteristics of the one or more behavioral factors, determining one or more dynamic weights corresponding to the one or more behavioral factors based at least in part on the one or more current values and historically expected values of the one or more behavioral factors for the user, and determining a risk metric corresponding to the anomalous activity of the user based on the surprisal values, the one or more dynamic weights, and static weights assigned to the one or more behavioral factors.