Hierarchical models using self organizing learning topologies

1. A method comprising:

maintaining, at a device in a network, a plurality of anomaly detection models for different sets of aggregated traffic data regarding traffic in the network;

determining, by the device, a measure of confidence in a particular one of the anomaly detection models that evaluates a particular set of aggregated traffic data;

dynamically replacing, by the device, the particular anomaly detection model with a second anomaly detection model configured to evaluate the particular set of aggregated traffic data and has a different model capacity than that of the particular anomaly detection model;

providing, by the device, an anomaly event notification to a supervisory controller based on a combined output of the second anomaly detection model and of one or more of the anomaly detection models in the plurality of anomaly detection models;

assigning, by the device, a selected first anomaly detection model from the plurality of anomaly detection models to a competition bucket group;

determining, by the device, an anomaly detection score using the selected first anomaly detection model assigned to the competition bucket group; and

including, by the device, the anomaly detection score in a report of most anomalous scores associated with the competition bucket group.

2. The method as in claim 1 , further comprising:

receiving, at the device and from the supervisory controller, data indicative of the types of sets of aggregated traffic data that the device should model.

3. The method as in claim 1 , further comprising:

dynamically adjusting, by the device, which outputs of the one or more anomaly detection models in the plurality of anomaly detection models should be combined with that of the second anomaly detection model based on available resource of the device.

4. The method as in claim 1 , further comprising:

assigning, by the device, a selected second anomaly detection model from the plurality of anomaly detection models to the competition bucket group;

determining, by the device, anomaly detection scores using the selected first and second anomaly detection models assigned to the competition bucket group; and

including, by the device, a selected one of the determined anomaly detection scores in the report of most anomalous scores associated with the competition bucket group.

5. The method as in claim 4 , wherein the report of most anomalous scores limits the number of anomaly scores that can be associated with any of the different sets of aggregated traffic data.

6. The method as in claim 1 , further comprising:

receiving, at the device, an indication of one or more nodes in the network that execute anomaly detection models that are similar to that of the plurality of anomaly detection models maintained at the device; and

combining, by the device, an anomaly detection model from one or more of the nodes with one or more of the plurality of anomaly detection models maintained at the device.

7. The method as in claim 6 , further comprising:

requesting, by the device, the indication of the one or more nodes in response to a determination that one of the plurality of anomaly detection models has a low confidence value.

8. The method as in claim 1 , wherein the aggregated traffic data aggregates one or more of: an application classification of the traffic, a source address or port of the traffic, a destination address or port of the traffic, a source group of host devices associated with the traffic, or a destination group of host devices associated with the traffic.

9. An apparatus, comprising:

one or more network interfaces to communicate with a network;

a processor coupled to the network interfaces and configured to execute one or more processes; and

a memory configured to store a process executable by the processor, the process when executed operable to:

maintain a plurality of anomaly detection models for different sets of aggregated traffic data regarding traffic in the network;

determine a measure of confidence in a particular one of the anomaly detection models that evaluates a particular set of aggregated traffic data;

dynamically replace the particular anomaly detection model with a second anomaly detection model configured to evaluate the particular set of aggregated traffic data and has a different model capacity than that of the particular anomaly detection model;

provide an anomaly event notification to a supervisory controller based on a combined output of the second anomaly detection model and of one or more of the anomaly detection models in the plurality of anomaly detection models;

assign a selected first anomaly detection model from the plurality of anomaly detection models to a competition bucket group;

determine an anomaly detection score using the selected first anomaly detection model assigned to the competition bucket group; and

include the anomaly detection score in a report of most anomalous scores associated with the competition bucket group.

10. The apparatus as in claim 9 , wherein the process when executed is further operable to:

receive, from the supervisory controller, data indicative of the types of sets of aggregated traffic data that the apparatus should model.

11. The apparatus as in claim 9 , wherein the process when executed is further operable to:

dynamically adjust which outputs of the one or more anomaly detection models in the plurality of anomaly detection models should be combined with that of the second anomaly detection model based on available resource of the apparatus.

12. The apparatus as in claim 9 , wherein the process when executed is further operable to:

assign a selected second anomaly detection model from the plurality of anomaly detection models to the competition bucket group;

determine anomaly detection scores using the selected first and second anomaly detection models assigned to the competition bucket group; and

include a selected one of the determined anomaly detection scores in the report of most anomalous scores associated with the competition bucket group.

13. The method as in claim 12 , wherein the report of most anomalous scores limits the number of anomaly scores that can be associated with any of the different sets of aggregated traffic data.

14. The apparatus as in claim 9 , wherein the process when executed is further operable to:

receive an indication of one or more nodes in the network that execute anomaly detection models that are similar to that of the plurality of anomaly detection models maintained at the apparatus; and

combine an anomaly detection model from one or more of the nodes with one or more of the plurality of anomaly detection models maintained at the apparatus.

15. The apparatus as in claim 14 , wherein the process when executed is further operable to:

request the indication of the one or more nodes in response to a determination that one of the plurality of anomaly detection models has a low confidence value.

16. The apparatus as in claim 9 , wherein the aggregated traffic data aggregates one or more of: an application classification of the traffic, a source address or port of the traffic, a destination address or port of the traffic, a source group of host devices associated with the traffic, or a destination group of host devices associated with the traffic.

17. A tangible, non-transitory, computer-readable medium storing program instructions that cause a device in a network to execute a process comprising:

maintaining a plurality of anomaly detection models for different sets of aggregated traffic data regarding traffic in the network;

determining a measure of confidence in a particular one of the anomaly detection models that evaluates a particular set of aggregated traffic data;

dynamically replacing the particular anomaly detection model with a second anomaly detection model configured to evaluate the particular set of aggregated traffic data and has a different model capacity than that of the particular anomaly detection model; and

providing an anomaly event notification to a supervisory controller based on a combined output of the second anomaly detection model and of one or more of the anomaly detection models in the plurality of anomaly detection models;

assigning a selected first anomaly detection model from the plurality of anomaly detection models to a competition bucket group;

determining an anomaly detection score using the selected first anomaly detection model assigned to the competition bucket group; and

including the anomaly detection score in a report of most anomalous scores associated with the competition bucket group.

18. The tangible, non-transitory, computer-readable medium as in claim 17 , wherein the device is an edge router.

19. The tangible, non-transitory, computer-readable medium as in claim 17 , the process further comprising:

assigning, by the device, a selected second anomaly detection model from the plurality of anomaly detection models to the competition bucket group;

determining, by the device, anomaly detection scores using the selected first and second anomaly detection models assigned to the competition bucket group; and

including, by the device, a selected one of the determined anomaly detection scores in the report of most anomalous scores associated with the competition bucket group.

20. The tangible, non-transitory, computer-readable medium as in claim 19 , wherein the report of most anomalous scores limits the number of anomaly scores that can be associated with any of the different sets of aggregated traffic data.