Network alert detection utilizing trained edge classification models

A method comprising:

• generating a set of training samples based on a set of error codes;
• training a plurality of classification models at a core for detection of signatures representing patterns of one or more alerts, wherein the training is based at least in part on the generated set of training samples, wherein the plurality of classification models comprises at least a first classification model to detect one or more signatures from a single node within one or more clusters of nodes and a second classification model to detect one or more signatures from a set of nodes within the one or more clusters of nodes;
• deploying the plurality of trained classification models at an edge of a network, wherein deploying the plurality of trained classification models comprises deploying at least one of the plurality of classification models in a virtual machine;
• receiving one or more alerts from one or more nodes within the one or more clusters of nodes in the network;
• detecting one or more of the signatures from a single node or a set of nodes within the one or more clusters of nodes by processing the received one or more alerts at the trained first classification model or second classification model of the plurality of trained classification models;
• and
• performing one or more actions to address a signature upon the signature being detected by the trained first classification model or second classification model of the plurality of trained classification models.

A non-transitory computer-readable storage medium storing instructions that, when executed by a processor, cause the processor to:

• train a plurality of classification models at a core for detection of signatures based on training data derived from a set of error codes, the plurality of trained classification models comprising:
• a first classification model to detect one or more signatures in one or more alerts from a single node within one or more clusters of nodes, and
• a second classification model to detect one or more signatures in a plurality of alerts from a set of nodes within the one or more clusters of nodes, wherein the second classification model is different from the first classification model;
• deploy the plurality of trained classification models at an edge of a network, wherein deploying the plurality of trained classification models comprises deploying at least one of the plurality of classification models in a virtual machine;
• receive alerts from one or more nodes within the one or more clusters of nodes of the network;
• detect one or more of the signatures from the single node by processing the received alerts at the first classification model;
• and
• detect one or more of the signatures from the set of nodes by processing the received alerts at the second-classification model.