Described are computing systems and methods as well as computer program products for enhancing the detection of abnormal online user behavior by incorporating time-series data of behavior-based user clusters into an entity graph for purposes of entity resolution. In various embodiments, graph analysis performed on a graph that includes nodes representing users, user attributes, and user clusters serves to determine groups of similar user entities, which may then be merged and/or further analyzed to detect abnormal behavior.