Detection of malicious user communities in data networks