Methods, systems, and apparatus, including computer programs encoded on computer storage media, for classifying user behavior as anomalous. One of the methods includes obtaining user behavior data representing behavior of a user in a subject system. An initial model is generated from training data, the initial model having first characteristic features of the training data. A resampling model is generated from the training data and from multiple instances of the first representation for a test time period. A difference between the initial model and the resampling model is computed. The user behavior in the test time period is classified as anomalous based on the difference between the initial model and the resampling model.
Please help me write a proper abstract based on the patent claims. CLAIM: 1. A computer-implemented method comprising: obtaining user behavior data representing behavior of a user in a subject system, wherein the user behavior data indicates one or more resources accessed by the user in the subject system and, for each resource accessed by the user, when the resource was accessed; generating test data from the user behavior data, the test data comprising a first representation of resources accessed by the user during a test time period; generating training data from the user behavior data, the training data comprising a respective second representation of resources accessed by the user for each of multiple time periods prior to the test time period; generating an initial model from the training data, the initial model having first characteristic features of the training data; generating a resampling model from the training data and from multiple instances of the first representation for the test time period, the resampling model having second characteristic features of the training data and the multiple instances of the first representation for the test time period; computing a difference between the initial model and the resampling model including comparing the first characteristic features of the training data and the second characteristic features of the training data and the multiple instances of the first representation for the test time period; and classifying the user behavior in the test time period as anomalous based on the difference between the initial model and the resampling model. 2. The method of claim 1, wherein the user behavior data comprises user access records that each represent a folder or a file accessed by the user in a file system. 3. The method of claim 1, further comprising: generating a first matrix that includes vectors of the training data and N instances of a same vector of the test data; and performing principal component analysis on the first matrix to generate a first plurality of principal components of the first matrix; generating a second matrix from a plurality of vectors of the training data; and performing principal component analysis on the second matrix to generate a second plurality of principal components of the second matrix, wherein computing a difference between the initial model and the resampling model comprises computing an angle between one or more of the first plurality of principal components and the second plurality of principal components. 4. The method of claim 1, further comprising: generating a first matrix that includes vectors of the training data and N instances of a same vector of the test data; performing singular value decomposition on the first matrix to generate a first plurality of principal components of the first matrix; generating a second matrix from a plurality of vectors of the training data; and performing singular value decomposition on the second matrix to generate a second plurality of principal components of the second matrix, wherein computing a difference between the initial model and the resampling model comprises computing an angle between one or more of the first plurality of principal components and the second plurality of principal components. 5. A computer-implemented method comprising: obtaining a plurality of topics, each topic being data representing a plurality of file types that frequently co-occur in user behavior data of individual users; obtaining user behavior data representing behavior of a user in a subject system, wherein the user behavior data indicates file types of files accessed by the user in the subject system and when the file was accessed by the user; generating test data from the user behavior data, the test data comprising a first representation of which topics the user accessed during a test time period according to the file types of the user behavior data; generating training data from the user behavior data, the training data comprising respective second representations of which topics the user accessed in each of multiple time periods prior to the test time period; generating an initial SVD model from the test data; generating a resampling model from the training data from multiple instances of the first representation of which topics the user accessed during the test time period; computing a difference between the initial model and the resampling model; and classifying the user behavior in the test time period as anomalous based on the difference between the initial model and the resampling model. 6. The method of claim 5, further comprising generating the plurality of topics from file types of files accessed by multiple users in the subject system. 7. The method of claim 6, further comprising: generating the topics using a topic modeling process including defining each user to be a document and each file type accessed by each user to be a term in the corresponding document. 8. The method of claim 7, wherein generating the topics using the topic modeling process comprises generating a predetermined number K of topics. 9. The method of claim 7, further comprising: iterating over a plurality of candidate values of K; and selecting a particular candidate value of K as the predetermined number K. 10. A computer-implemented method comprising: obtaining user behavior data representing behavior of a user in a subject system, wherein the user behavior data indicates one or more resources accessed by the user in the subject system and, for each resource accessed by the user, when the resource was accessed; generating test data from the user behavior data, the test data comprising a first representation of resources accessed by the user during a test time period; generating training data from the user behavior data, the training data comprising respective second representations of resource accessed by the user in each of multiple time periods prior to the test time period; generating an initial path graph from the training data, wherein the initial path graph comprises nodes that represent resources accessed by the user in the subject system during one or more time periods represented by the training data, and links between one or more pairs of nodes, wherein each link between each pair of nodes represents that the user accessed a first resource represented by a first node of the pair from a second resource represented by a second node of the pair; generating a test path graph from the test data, wherein the test path graph comprises nodes that represent resources accessed by the user in the subject system during the test time period, and links between one or more pairs of nodes, wherein each link between each pair of nodes represents that the user accessed a first resource represented by a first node of the pair from a second resource represented by a second node of the pair; computing a difference between the initial path graph and the test path graph; and classifying the user behavior by the user in the test time period as anomalous based on the difference between the initial path graph and the test path graph. 11. The method of claim 10, wherein the user behavior data comprises user access records that each represent a folder or a file accessed by the user in a file system. 12. The method of claim 10, wherein generating the initial path graph comprises generating the initial path graph from training data of the user and training data of one or more peers of the user in the subject system. 13. The method of claim 12, further comprising: determining one or more other users in the subject system that accessed at least a threshold number of resources in common with the user during the time periods represented by the training data; and designating the one or more other users as peers of the user in the subject system. 14. The method of claim 10, wherein computing the difference between the initial path graph and the test path graph comprises computing a Jaccard distance between the initial path graph and the test path graph, wherein the Jaccard distance is based on the cardinality of intersecting nodes between the initial path graph and the test path graph, and the cardinality of the union of nodes between the initial path graph and the test path graph. 15. The method of claim 10, wherein computing the difference between the initial path graph and the test path graph comprises: obtaining weights associated with resources represented by nodes in the initial path graph and the test path graph; and computing a weighted Jaccard distance between the initial path graph and the test path graph, wherein the weighted Jaccard distance is based on a sum of weights for all nodes that occur in the intersection of the initial path graph and the test path graph, and the sum of weights for all nodes that occur in the test path graph. 16. The method of claim 15, further comprising assigning higher a weight to a folder in the subject system than a subfolder of the folder in the subject system. 17. The method of claim 15, further comprising assigning a same weight to all resources in the subject system that are above a threshold number of levels in a hierarchy of the resources. 18. The method of claim 15, wherein the weights are based on a measure of popularity of the resources. 19. The method of claim 18, further comprising: generating a hybrid graph, wherein the hybrid graph comprises user nodes that represent users in the system and resource nodes that represent resources in the system, wherein the hybrid graph includes user-resource links, wherein each user-resource link represents a respective user accessing a resource in the system, and resource-resource links, wherein each resource-resource link represents a structure of resources in the system; computing a measure of popularity for one or more resources in the system according to the hybrid graph; selecting one or more nodes having the highest measures of popularity; and adding, to the initial path graph for the user, paths to each of the one or more nodes having the highest measures of popularity.