Machine-to-Machine Anomaly Detection

An apparatus comprising:

• a communications interface for receiving first flow data associated with a plurality of hosts, and second flow data associated with a target host, the target host included in the plurality of hosts;
• and
• a processor configured to:
• compute a first plurality of feature vectors from the first flow data;
• assign a label to each feature vector of the first plurality of feature vectors;
• train a host classifier using particular ones of the labeled feature vectors of the first plurality of feature vectors;
• compute a second plurality of feature vectors from the second flow data;
• and
• classify one or more of the feature vectors from the second plurality of feature vectors using the trained host classifier.

A non-transitory computer-readable medium storing computer program instructions for anomaly detection, the computer program instructions, when executed on a processor, cause the processor to perform operations comprising:

• receiving first flow data associated with a plurality of hosts;
• computing a first plurality of feature vectors from the first flow data;
• assigning a label to each feature vector of the first plurality of feature vectors;
• training a host classifier using particular ones of the labeled feature vectors of the first plurality of feature vectors;
• receiving second flow data associated with a target host, the target host included in the plurality of hosts;
• computing a second plurality of feature vectors from the second flow data;
• and
• classifying one or more of the feature vectors from the second plurality of feature vectors using the trained host classifier.