Network anomaly detection using machine learning models

1. A computerized method for anomaly detection performed by one or more processors, the method comprising:

employing a first machine learning model to determine a network anomaly within network traffic, the first machine learning model identifying the network anomaly in response to a first input of the network traffic from network tunnels through which the network traffic passes;

employing a second machine learning model to determine a router-specific anomaly within router-specific network traffic from a subset of the network tunnels through which the router-specific network traffic passes, the second machine learning model identifying the router-specific anomaly in response to a second input of a portion of the network traffic from the subset of network tunnels through which the router-specific network traffic passes, the second machine learning model included within a plurality of machine learning models that are each trained on router-specific network traffic corresponding to different subsets of the network tunnels;

based on determining the network anomaly within the network traffic and the second machine learning model of the plurality determining the router-specific anomaly within the router-specific network traffic, identifying a router associated with the router-specific network traffic and the corresponding subset of network tunnels from among the different network tunnels as experiencing a router error; and

communicating an indication of the router error based on the identification of the router.

2. The method of claim 1 , wherein the first machine learning model or the second machine learning model is a long short-term memory (LSTM) autoencoder.

3. The method of claim 1 , wherein the second machine learning model is an isolation forest model.

4. The method of claim 1 , wherein the network traffic is Multiprotocol Label Switching (MPLS) traffic.

5. The method of claim 1 , wherein the network traffic is associated with a network comprising a plurality of routers that includes the router, the first machine learning model having been trained on historical network traffic from the network tunnels corresponding to the plurality of routers, and the second machine learning model having been trained on a portion of the historical network traffic specific to only the subset of the network tunnels corresponding to the router.

6. The method of claim 1 , wherein the first machine learning model determines the network anomaly based on comparing a mean error output of the first machine learning model to a mean error threshold value.

7. The method of claim 1 , wherein the second machine learning model is employed in response to the first machine learning model determining the network anomaly.

8. One or more computer storage media storing computer-readable instructions that when executed by a processor, cause the processor to perform operations of anomaly detection, the operations comprising:

training a first machine learning model on historical network traffic passed through network tunnels of a network, the network comprising a plurality of routers that correspond to subsets of the network tunnels;

training a plurality of machine learning models on router-specific network traffic, each machine learning model of the plurality trained on router-specific network traffic corresponding to different subsets of the network tunnels, the plurality of machine learning models comprising a second machine learning model trained on historical router-specific network traffic passed through a subset of the network tunnels associated with a router of the plurality of routers; and

providing the first machine learning model for determining a network anomaly within network traffic from the network tunnels, and the second machine learning model for determining a router-specific anomaly within router-specific network traffic from the subset of the network tunnels corresponding to the second machine learning model, wherein determining the router-specific anomaly by the second machine learning model identifies the router corresponding to the second machine learning model as experiencing a router error.

9. The media of claim 8 , wherein the first machine learning model or the second machine learning model is a long short-term memory (LSTM) autoencoder.

10. The media of claim 8 , wherein the second machine learning model is an isolation forest model.

11. The media of claim 8 , wherein the network traffic is Multiprotocol Label Switching (MPLS) traffic.

12. The media of claim 8 , wherein the historical network traffic comprises a first time series of throughput measurements for each of the network tunnels, and wherein the historical router-specific network traffic comprises a second time series of throughput measurements for only the subset of the network tunnels associated with the router.

13. The media of claim 8 , wherein a loss function utilized when training the first machine learning model or the second machine learning model is mean error.

14. A system for anomaly detection, the system comprising:

a plurality of routers within a network, the plurality of routers directing network traffic passed through network tunnels, wherein each router of the plurality directs router-specific network traffic passed through a subset of the network tunnels;

at least one processor; and

one or more computer storage media storing computer-readable instructions that when executed by the at least one processor, cause the at least one processor to:

employ a first machine learning model to determine a network anomaly within the network traffic, the first machine learning model receiving the network traffic as a first input;

employ a plurality of machine learning models on the router-specific network traffic, each machine learning model employed on router-specific network traffic corresponding to different subsets of the network tunnels, wherein a second machine learning model, within the plurality of machine learning models, determines a router-specific anomaly within the router-specific network traffic for a router of the plurality of routers, the second machine learning model receiving a portion of the network traffic from the corresponding subset of network tunnels as a second input;

based on determining a network anomaly within the network traffic and determining the router-specific anomaly in the router-specific network traffic by the second machine learning model, identifying the router corresponding to the second machine learning model as experiencing a router error; and

communicate an indication of the router error associated with the router.

15. The system of claim 14 , wherein the computer storage media further causes the at least one processor to:

train the first machine learning model on historical network traffic passed through the network tunnels of the network; and

train the second machine learning model on historical router-specific network traffic passed through the subset of the network tunnels associated with the router.

16. The system of claim 15 , wherein the historical network traffic comprises a first time series of throughput measurements for each of the network tunnels, and wherein the historical router-specific network traffic comprises a second time series of throughput measurements for only the subset of the network tunnels associated with the router.

17. The system of claim 15 , wherein a loss function utilized when training the first machine learning model or the second machine learning model is mean error.

18. The system of claim 14 , wherein the first machine learning model or the second machine learning model is a long short-term memory (LSTM) autoencoder.

19. The system of claim 14 , wherein the second machine learning model is an isolation forest model.

20. The system of claim 14 , wherein the network traffic is Multiprotocol Label Switching (MPLS) traffic.