Platform for privacy preserving decentralized learning and network event monitoring

A method comprising:

• receiving, at a central server, a classified label for a network tuple parameter, wherein the classified label was generated by:
• monitoring flow behaviors for data flow traffic at a network device;
• applying a machine learning (ML) model that comprises labelled network tuples and signatures for flow behaviors to the monitored flow behaviors to classify the monitored flow behaviors and generate a classified label;
• and
• wherein the classified label is received if a comparison of the classified label for the network tuple parameter was determined to differ from an implicit label, and wherein the implicit label corresponds with a network tuple parameter as reported in a packet header of a corresponding data flow of the data flow traffic;
• and
• performing an action based on the classified label.

A non-transitory machine readable storage medium storing a plurality of instructions executable by one or more processors, the plurality of instructions when executed by the one or more processors cause the one or more processors to:

• receive a set of flow behaviors for data flow traffic;
• apply a machine learning (ML) model that comprises labelled network tuples and signatures for flow behaviors to the set of flow behaviors, wherein output from the machine learning model predicts a classified label for a particular data flow of the data flow traffic;
• determine an implicit label for a network tuple parameter for the particular data flow, wherein the implicit label comprises a reported value for the network tuple parameter;
• compare the classified label for the network tuple parameter to the implicit label;
• and
• perform an action associated with the comparison.