Online Anomaly Detection of Vector Embeddings

A method, comprising:

• receiving a network flow associated with a network device;
• comparing the network flow to one or more flow clusters associated with the network device;
• and
• determining, based on the comparing and at a flow level, whether the network flow indicates an anomaly in a behavior of the network device.

A system, comprising:

• a memory;
• and
• at least one processor coupled to the memory and configured to:
• determine one or more similarity values between a flow vector corresponding to a flow associated with a network device and one or more flow clusters associated with the network device;
• determine a maximum similarity value as a maximum of the one or more similarity values;
• compare the maximum similarity value to a threshold;
• in response to the maximum similarity value being equal to or greater than the threshold, update a flow cluster associated with the maximum similarity value;
• and
• in response to the maximum similarity measure being less than the threshold, detect an anomaly in the network device and generate an alert message based on the detected anomaly.