Self organizing learning topologies

An apparatus, comprising:

• one or more network interfaces to communicate with a network;
• a processor coupled to the network interfaces and configured to execute one or more processes;
• and
• a memory configured to store a process executable by the processor, the process when executed operable to:
• receive a plurality of edge identifiers for a plurality of edges, wherein a particular edge represents an interaction between two or more device clusters formed by one or more routers, each device cluster comprising a plurality of host devices having similar characteristics;
• select a set of edges from among the plurality of edges that are expected to exhibit similar behaviors;
• correlate received information regarding anomaly detection models associated with the selected set of edges, to determine a measure of confidence in the anomaly detection models associated with the selected set of edges based on an assessment of how similar the anomaly detection models are to each another;
• provide a notification that comprises the measure of confidence;
• and
• provide a clustering policy to the one or more routers, wherein the one or more routers are configured to form the device clusters based on the provided clustering policy.

A tangible, non-transitory, computer-readable medium storing program instructions that, when executed by a device in a network perform a process comprising:

• receiving, at a device, a plurality of edge identifiers for a plurality of edges, wherein a particular edge represents an interaction between two or more device clusters formed by one or more routers, each device cluster comprising a plurality of host devices having similar characteristics;
• selecting, by the device, a set of edges from among the plurality of edges that are expected to exhibit similar behaviors;
• correlating, by the device, received information regarding anomaly detection models associated with the selected set of edges, to determine a measure of confidence in the anomaly detection models associated with the selected set of edges based on an assessment of how similar the anomaly detection models are to each another;
• providing, by the device, a notification that comprises the measure of confidence;
• and
• providing, by the device, a clustering policy to the one or more routers, wherein the one or more routers are configured to form the device clusters based on the provided clustering policy.