Mechanisms to prevent anomaly detectors from learning anomalous patterns

1. A method comprising:

detecting, by a device in a network, an anomaly in the network by analyzing a set of sample data regarding one or more conditions of the network using a behavioral analytics model;

receiving, at the device, feedback regarding the detected anomaly;

determining, by the device, that the anomaly was a true positive based on the received feedback; and

excluding, by the device, the set of sample data from a training set for the behavioral analytics model, in response to determining that the anomaly was a true positive by:

training, by the device, the behavioral analytics model using the set of sample data as part of the training set, wherein training includes:

determining, by the device, that expiration of a feedback timer has occurred based on the device not receiving the feedback regarding the detected anomaly within a feedback time period, wherein the device trains the behavioral analytics model using the set of sample data as part of the training set in response to the expiration of the feedback time, and

storing, by the device, the set of sample data for a retention period of time to revert the behavioral analytics model after training the behavioral analytics model using the set of sample data, in case the feedback regarding the detected anomaly is received after expiration of the feedback timer, and

reverting, by the device, the behavioral analytics model to exclude the set of sample data from the training set, in response to determining that the anomaly was a true positive.

2. The method as in claim 1 , wherein the device is an edge router.

3. The method as in claim 1 , further comprising:

providing, by the device, information regarding the detected anomaly to a user interface, wherein the feedback regarding the detected anomaly is received via the user interface.

4. The method as in claim 1 , further comprising:

determining, by the device, that a second anomaly detected by the behavioral analytics model is irrelevant; and

training, by the device, the behavioral analytics model using a second set of sample data that caused the behavioral analytics model to detect the second anomaly, wherein a weight of the second set of sample data is increased in the training set for the behavioral analytics model based on the determination that the second anomaly is irrelevant.

5. The method as in claim 4 , further comprising:

training, by the device, the behavioral analytics model using the second set of sample data; and

retraining, by the device, the behavioral analytics model using the second set of sample data with the increased weight, in response to determining that the second anomaly is irrelevant.

6. The method as in claim 4 , wherein determining that the second anomaly detected by the behavioral analytics model is irrelevant comprises:

receiving, at the device, feedback from a user interface regarding the second anomaly that indicates that the second anomaly is irrelevant, wherein the weight of the second set of sample data is based on the received feedback regarding the second anomaly.

7. An apparatus, comprising:

one or more network interfaces to communicate with a network;

a processor coupled to the network interfaces and configured to execute one or more processes; and

a memory configured to store a process executable by the processor, the process when executed operable to:

detect an anomaly in the network by analyzing a set of sample data regarding one or more conditions of the network using a behavioral analytics model;

receive feedback regarding the detected anomaly;

determine that the anomaly was a true positive based on the received feedback; and

exclude the set of sample data from a training set for the behavioral analytics model, in response to determining that the anomaly was a true positive by:

training, by the device, the behavioral analytics model using the set of sample data as part of the training set, wherein training includes:

determining, by the device, that expiration of a feedback timer has occurred based on the device not receiving the feedback regarding the detected anomaly within a feedback time period, wherein the device trains the behavioral analytics model using the set of sample data as part of the training set in response to the expiration of the feedback time, and

storing, by the device, the set of sample data for a retention period of time to revert the behavioral analytics model after training the behavioral analytics model using the set of sample data, in case the feedback regarding the detected anomaly is received after expiration of the feedback timer, and

reverting, by the device, the behavioral analytics model to exclude the set of sample data from the training set, in response to determining that the anomaly was a true positive.

8. The apparatus as in claim 7 , wherein the apparatus is an edge router.

9. The apparatus as in claim 7 , wherein the process when executed is further operable to:

provide information regarding the detected anomaly to a user interface, wherein the feedback regarding the detected anomaly is received via the user interface.

10. The apparatus as in claim 7 , wherein the process when executed is further operable to:

determine that a second anomaly detected by the behavioral analytics model is irrelevant; and

train the behavioral analytics model using a second set of sample data that caused the behavioral analytics model to detect the second anomaly, wherein a weight of the second set of sample data is increased in the training set for the behavioral analytics model based on the determination that the second anomaly is irrelevant.

11. The apparatus as in claim 10 , wherein the process when executed is further operable to:

train the behavioral analytics model using the second set of sample data; and

retrain the behavioral analytics model using the second set of sample data with the increased weight, in response to determining that the second anomaly is irrelevant.

12. The apparatus as in claim 11 , wherein the apparatus determines that the second anomaly detected by the behavioral analytics model is irrelevant by:

receiving feedback from a user interface regarding the second anomaly that indicates that the second anomaly is irrelevant, wherein the weight of the second set of sample data is based on the received feedback regarding the second anomaly.

13. A tangible, non-transitory, computer-readable medium storing program instructions that cause a device in a network to execute a process comprising:

detecting an anomaly in the network by analyzing a set of sample data regarding one or more conditions of the network using a behavioral analytics model;

receiving feedback regarding the detected anomaly;

determining that the anomaly was a true positive based on the received feedback; and

excluding the set of sample data from a training set for the behavioral analytics model, in response to determining that the anomaly was a true positive by:

training, by the device, the behavioral analytics model using the set of sample data as part of the training set, wherein training includes:

determining, by the device, that expiration of a feedback timer has occurred based on the device not receiving the feedback regarding the detected anomaly within a feedback time period, wherein the device trains the behavioral analytics model using the set of sample data as part of the training set in response to the expiration of the feedback time, and

storing, by the device, the set of sample data for a retention period of time to revert the behavioral analytics model after training the behavioral analytics model using the set of sample data, in case the feedback regarding the detected anomaly is received after expiration of a feedback timer, and

reverting, by the device, the behavioral analytics model to exclude the set of sample data from the training set, in response to determining that the anomaly was a true positive.

14. The computer-readable medium as in claim 13 , wherein the feedback regarding the detected anomaly comprises votes received from a plurality of user interfaces as to whether the detected anomaly is relevant.