Systems and methods for network anomaly detection and policy-based network state restoration

A system, comprising:

• one or more memories having computer-readable instructions stored thereon;
• and
• one or more processors that execute the computer-readable instructions to:
• collect a first set of metrics associated with a network at a first time, the first set of metrics indicating a first state of the network, and store the first set of metrics in association with the first state in a memory at the first time;
• collect a second set of metrics associated with the network at a second time, the second set of metrics indicating a second state of the network;
• determine an indication of an anomaly on the network based on a comparison of the second set of metrics with the first set of metrics;
• and
• apply a network policy to revert the network from the second state to the first state by restoring network traffic attributes and operational parameters of the network to match the stored first set of metrics, wherein the reverting is performed prior to determining a type of anomaly associated with the anomaly, thereby enabling rapid restoration regardless of the anomaly type, in response to determining the indication of the anomaly.

A non-transitory computer-readable storage media comprising computer-readable instructions stored thereon that, when executed by one or more processors, cause the one or more processors to:

• collect a first set of metrics associated with a network at a first time, the first set of metrics indicating a first state of the network, and store the first set of metrics in association with the first state in a memory at the first time;
• collect a second set of metrics associated with the network at a second time, the second set of metrics indicating a second state of the network;
• determine an indication of an anomaly on the network based on a comparison of the second set of metrics with the first set of metrics;
• and
• apply a network policy to revert the network from the second state to the first state by restoring network traffic attributes and operational parameters of the network to match the stored first set of metrics, wherein the reverting is performed prior to determining a type of anomaly associated with the anomaly, thereby enabling rapid restoration regardless of the anomaly type, in response to determining the indication of the anomaly.