A cyber security method including: obtaining user flow data associated with a browsing session at a website; constructing a directed graph representative of the browsing session; computing a set of features for the directed graph; and applying a machine learning classifier to the set of features, to classify the browsing session as legitimate or fraudulent.