A system, method, and computer program for identifying evolving regions in a graph of interrelated nodes representing a computer system environment. The method includes generating a series of samples (302) of the environment. Each sample includes a plurality of interrelated nodes (502) and at least one edge (504) classified into a plurality of at least one of node type and edge type, respectively. A summary (900) of the plurality of at least one of node type (502) and edge type (504) is created for the series of samples (302). A summary instance (312) of the summary (900) is created for each sample. At least one summary instance (312) is compared to at least one subsequent summary instance (314) and at least one result (318) is stored in memory (106). A successive behavior is characterized for one or more of the at least one of the node type and the edge type.