Vector-Based Anomaly Detection

A network fabric system comprising:

• a plurality of network nodes distributed across a network fabric;
• and
• at least one processor coupled with the plurality of network nodes and configured to:
• determine a baseline vector corresponding to nominal behavior of the network fabric, the baseline vector comprising at least two different behavior metrics that are correlated with each other, the baseline vector representing a dynamic behavior of the network fabric including a representation of how the at least two different behavior metrics correlate with each other;
• establish anomaly detection criteria as a function of a variation from the baseline vector, the anomaly detection criteria defining an envelope around a correlation of the at least two different behavior metrics, the envelope comprising contours representing degrees of detection of anomalous behavior;
• disaggregate the anomaly detection criteria into a plurality of anomaly criterion to be distributed among the plurality of network nodes, each of the plurality of anomaly criterion comprising a function of a measured vector of behavior metrics;
• aggregate anomaly criterion statuses calculated by at least some of the plurality of network nodes, each anomaly criterion status being calculated by a respective network node as a function of the respective network node's anomaly criterion and a measured vector of the at least two different behavior metrics;
• determine a degree of satisfaction of the anomaly detection criteria as a function of the aggregated anomaly criterion statuses, wherein the degree of satisfaction varies based on a proximity of the aggregated anomaly criterion statuses to the contours of the envelope;
• and
• trigger an operation based on the determined degree of satisfaction.

A non-transitory computer-readable medium storing instructions that, when executed by one or more processors of a network fabric comprising a plurality of network nodes, cause the one or more processors to:

• determine a baseline vector corresponding to nominal behavior of the network fabric, the baseline vector comprising at least two different behavior metrics that are correlated with each other, the baseline vector representing a dynamic behavior of the network fabric including a representation of how the at least two different behavior metrics correlate with each other;
• establish anomaly detection criteria as a function of a variation from the baseline vector, the anomaly detection criteria defining an envelope around a correlation of the at least two different behavior metrics, the envelope comprising contours representing degrees of detection of anomalous behavior;
• disaggregate the anomaly detection criteria into a plurality of anomaly criterion to be distributed among the plurality of network nodes, each of the plurality of anomaly criterion comprising a function of a measured vector of behavior metrics;
• aggregate anomaly criterion statuses calculated by at least some of the plurality of network nodes, each anomaly criterion status being calculated by a respective network node as a function of the respective network node's anomaly criterion and a measured vector of the at least two different behavior metrics;
• determine a degree of satisfaction of the anomaly detection criteria as a function of the aggregated anomaly criterion statuses, wherein the degree of satisfaction varies based on a proximity of the aggregated anomaly criterion statuses to the contours of the envelope;
• and
• trigger an operation based on the determined degree of satisfaction.