In this work, we propose a new approach to detect anomalous graphs in a stream of directed and labeled heterogeneous edges. The stream consists of a sequence of edges derived from different graphs. Each of these dynamic graphs represents the evolution of a specific activity in a monitored system whose events are acquired in real-time. Our approach is based on graph clustering and uses a simple graph embedding based on substructures and graph edit distance. Our graph representation is flexible and updates incrementally the graph vectors as soon as a new edge arrives. This allows the detection of anomalies in real-time which is an important requirement for sensitive applications such as cyber-security. Our implementation results prove the effectiveness of our approach in terms of accuracy of detection and time processing.