Network anomaly detection

An apparatus, comprising:

• processing circuitry configured to
• extract one or more first features and an actual label from a first network control message collected from a network,
• predict a predicted label for a second network control message collected from the network based on one or more second features extracted from the second network control message, the one or more second features being input to a predictive model that is trained based on the one or more first features and the actual label, and
• detect a network anomaly of the network based on the predicted label.

A non-transitory computer-readable medium storing instructions that, when executed by a processor, cause the processor to perform a method, the method comprising:

• extracting one or more first features and an actual label from a first network control message collected from a network;
• predicting a predicted label for a second network control message collected from the network based on one or more second features extracted from the second network control message, the one or more second features being input to a predictive model that is trained based on the one or more first features and the actual label;
• and
• detecting a network anomaly of the network based on the predicted label.