A method, apparatus and product for automatic detection of anomalies in graphs. The method comprising obtaining training data, the training data comprising a plurality of graphs, each defined by nodes and edges connecting between the nodes, at least some of the nodes are labeled; determining a statistical model of a graph in accordance with the training data, the statistical model takes into account at least one structured and labeled feature of the graph, wherein the structured and labeled feature of the graph is defined based on a connection between a plurality of nodes and based on at least a portion of the labels of the plurality of nodes; obtaining an examined graph; and determining a score of the examined graph indicative of a similarity between the examined graph and the training data, wherein the score is based on a value of the structured and labeled feature in the examined graph.