Detecting network anomalies

A computer system comprising:

• a processor set;
• one or more computer-readable storage media;
• and
• program instructions stored on the one or more computer-readable storage media to cause the processor set to perform operations comprising:
• analyzing operational time series data corresponding to a first number of hops and a first average travel time of a first plurality of data packets traversing a network from source devices to destination devices over a given time epoch using a set of Kalman filters;
• generating aggregate representational error data that indicate expected network behavior for the network regarding data packet number of hops and average travel time in the network based on analyzing the operational time series data using the set of Kalman filters;
• determining an amount of change between the aggregate representational error data for the network and number of hops data and average travel time data based on comparing the aggregate representational error data that indicate expected network behavior for the network regarding the data packet number of hops and average travel time in the network with the number of hops data and the average travel time data that indicate any changes in the data packet number of hops and average travel time in the network;
• determining whether the amount of change between the aggregate representational error data for the network and at least one of the number of hops data and the average travel time data is greater than a defined maximum amount of change threshold level;
• and
• responsive to determining that the amount of change between the aggregate representational error data for the network and at least one of the number of hops data and the average travel time data is greater than the defined maximum amount of change threshold level, detecting that an anomaly exists in the network.

A computer program product comprising:

• one or more computer-readable storage media;
• and
• program instructions stored on the one or more computer-readable storage media to perform operations comprising:
• analyzing operational time series data corresponding to a first number of hops and a first average travel time of a first plurality of data packets traversing a network from source devices to destination devices over a given time epoch using a set of Kalman filters;
• generating aggregate representational error data that indicate expected network behavior for the network regarding data packet number of hops and average travel time in the network based on analyzing the operational time series data using the set of Kalman filters;
• determining an amount of change between the aggregate representational error data for the network and number of hops data and average travel time data based on comparing the aggregate representational error data that indicate expected network behavior for the network regarding the data packet number of hops and average travel time in the network with the number of hops data and the average travel time data that indicate any changes in the data packet number of hops and average travel time in the network;
• determining whether the amount of change between the aggregate representational error data for the network and at least one of the number of hops data and the average travel time data is greater than a defined maximum amount of change threshold level;
• and
• responsive to determining that the amount of change between the aggregate representational error data for the network and at least one of the number of hops data and the average travel time data is greater than the defined maximum amount of change threshold level, detecting that an anomaly exists in the network.