Method and system for training and validating machine learning in network environments

A system for training and validating machine learning algorithms in real network environments comprising an internal network and an external network providing real traffic through a network device, wherein the system comprises:

• at least one generator of synthetic traffic;
• a probe configured for:
• receiving packets of traffic comprising the real traffic and the generated synthetic traffic through the network device;
• aggregating the packets of the received traffic into network flows by using metadata;
• and
• transforming each network flow to generate a first dataset with a format readable by a machine learning algorithm, the first dataset comprising features defined by the metadata for each network flow;
• a train and validation module comprising:
• a labeller configured for:
• (i) labelling the real traffic and the synthetic traffic to obtain a labelled dataset which comprises the first dataset and additional features defined as labels, wherein the labelling is done by matching features from the first dataset and features collected by logs of metadata, and assigning an unknown label where there is no match;
• and
• a feature extractor configured for:
• (ii) selecting a subset of the features from the labelled dataset to be used in an iterative training to generate a trained model;
• (iii) filtering out a part of real traffic of the labelled dataset to obtain a second labelled dataset;
• (iv) selecting a subset of features used in the trained model from the second labelled dataset to be used for validating the trained model;
• and
• the train and validation module being further configured for:
• (v) comparing predicted results for the trained model and the labels obtained from labelling;
• and, if the comparison is negative, repeating steps (i)-(v) with a different subset of features to generate another trained model.