This paper presents a graph-based method of identifying suspicious activities and improving recovery efforts in response to the increasing complexity of network security threats. The proposed approach assumes that the network can be modeled as a dynamic graph where devices represent nodes and communication links represent the edges of the graph: graph theory will be used to identify anomalies based on centrality and clustering measures. The system tracks the performance of the network real-time, detecting a deviation that could mean breach of security. When it observes suspicious behavior, the technique activates autonomous recovery mechanisms, such as isolating nodes, rerouting traffic and recovering backup configuration so that the service is impacted significantly. According to the experimental findings, it can be seen that the proposed solution is much better than current methods and has a detection rate of 95, recovery time is 30 seconds when dealing with DDoS attacks and that network services are much less affected by such attacks. The suggested approach does not only increase the detection accuracy, but it also boosts its recovery efficiency, which results in quicker operations in the network. The findings point to the role that graph-based models could play in handling the contemporary cybersecurity issues.