Network traffic monitoring for anomalous behavior detection

A system comprising:

• a Charging Network Function (CHF) to:
• monitor a traffic pattern of a device of a group of devices in a network;
• and
• determine that the traffic pattern of the device deviates from an expected traffic pattern of the group of devices by a threshold;
• and
• a Policy Control Function (PCF) to:
• responsive to determining that the device deviates from the expected traffic pattern, inspect packet data transmitted by the device;
• determine that the packet data transmitted by the device is anomalous;
• and
• responsive to determining that the packet data transmitted by the device is anomalous, changing the status of the device.

A non-transitory computer readable medium including instructions thereon, wherein the instructions, when executed by a processor, cause the processor to:

• monitor a traffic pattern of a device of a group of devices in a network;
• determine that the traffic pattern of the device deviates from an expected traffic pattern of the group of devices by a threshold;
• responsive to determining that the device deviates from the expected traffic pattern, inspect packet data transmitted by the device;
• determine that the packet data transmuted by the device is anomalous;
• and
• responsive to determining that the packet data transmitted by the device is anomalous, change the status of the device.