Detecting attacks and quarantining malware infected devices

A non-transitory computer-readable medium having encoded therein programming code executable by one or more processors to perform or control performance of operations comprising:

• receiving, from a first device on a network, incoming network traffic;
• receiving previous network traffic from a second device having the same device type as the first device on an isolated network for a predetermined time period,
• creating a network traffic baseline based on the previous network traffic;
• comparing the network traffic baseline associated with the incoming network traffic;
• determining, based on the comparison, an anomaly type associated with the incoming network traffic;
• and
• changing access to the network by the first device according to an access restriction selected from a set of access restrictions, wherein the access restriction corresponds to the anomaly type.

A system comprising:

• one or more processors;
• and
• a non-transitory computer-readable medium including:
• a data collector executable by the one or more processors to receive, from a first device on a network, incoming network traffic, and to receive previous network traffic from a second device having the same device type as the first device on an isolated network for a predetermined time period;
• and
• a traffic analyzer executable by the one or more processors to:
• receive, from the data collector, the incoming network traffic and the previous network traffic;
• create a network traffic baseline based on the previous network traffic;
• compare the network traffic baseline with the incoming network traffic;
• determine, based on the comparison, an anomaly type associated with the incoming network traffic;
• and
• change access to the network by the first device according to an access restriction selected from a set of access restrictions, wherein the access restriction corresponds to the anomaly type.