Use case 4:

Machine-Learning based network flows anomaly detection

Issue description

Network flow and packet analysis is the ultimate data source for understanding network performance trends, organization productivity, and the detection of abnormal and malicious activity.

The traditional approach to network flow/packets analysis is based on deterministic algorithms. Good examples are setting the threshold for utilization at a static value (75% for example) or looking at very particular patterns in the flow to detect a known virus or attack.

A deterministic approach, while efficient to a certain degree, cannot adopt itself to the dynamic nature of the flows going through the network. Patterns in these flows are often too complex to be efficiently detected by strict algorithms based on traditional logic.


NFVgrid utilizes a Machine Learning/AI approach to analyze networking flows and packets. Based on this analysis behavioral models are built to determine patterns and thresholds. These models then applied to ongoing networking flows to threshold crossing and abnormalities in the on-going network flow.

The patterns are dynamic in nature and constantly getting automatically adjusted by the models based on present conditions or user input. This non-deterministic approach allows to efficiently adopt to ever changing nature of network activity.

Fully dynamic, self-learning analysis algorithms bring network management efficiency to a completely different level. They detect not only known issues and threads, but also new types of abnormalities, simply by comparing them to the historical behavior of the network.