Systems and methods include converting historical data into categorical time series data and de-noising the categorical time series data by removing noisy transitions sets according to a coefficient of variation. A likelihood of a category transition is determined based on historical events using a Hawkes process to generate a relationship graph. Relationships between pairs of nodes are determined using the relationship graph, where the relationships indicate a degree of correlation between the nodes based on de-noised categorical time-series data. An anomaly threshold is determined based on anomaly scores for a validation dataset using the relationship graph, wherein a likelihood output of the Hawkes process that exceeds the anomaly threshold indicates an anomaly.