Detecting network entity groups with abnormal time evolving behavior

An apparatus, comprising:

• one or more network interfaces to communicate with a network;
• a processor coupled to the network interfaces and configured to execute one or more processes;
• and
• a memory configured to store a process executable by the processor, the process when executed configured to:
• calculate network frequency distributions of a performance measurement from a monitored network over a plurality of different time periods;
• calculate entity frequency distributions of the performance measurement for a plurality of different groupings of one or more network entities in the network over the plurality of different time periods;
• determine distance measurements between the network frequency distributions and the entity frequency distributions;
• identify a particular one of the grouping of one or more networking entities as an outlier, based on a change in distance measurements between the network frequency distributions and the entity frequency distributions for the particular grouping;
• and
• provide an indication of the identified outlier grouping to a user interface.

A tangible, non-transitory, computer-readable medium storing program instructions that cause a network assurance service that monitors a network to execute a process comprising:

• calculating, by the network assurance service, network frequency distributions of a performance measurement from the network over a plurality of different time periods;
• calculating, by the network assurance service, entity frequency distributions of the performance measurement for a plurality of different groupings of one or more network entities in the network over the plurality of different time periods;
• determining, by the network assurance service, distance measurements between the network frequency distributions and the entity frequency distributions;
• identifying, by the network assurance service, a particular one of the grouping of one or more networking entities as an outlier, based on a change in distance measurements between the network frequency distributions and the entity frequency distributions for the particular grouping;
• and
• providing, by the network assurance service, an indication of the identified outlier grouping to a user interface.