Distributed learning in a computer network

An apparatus, comprising:

• one or more network interfaces to communicate in a computer network;
• a processor coupled to the network interfaces and configured to execute one or more processes;
• and
• a memory configured to store a process executable by the processor, the process when executed operable to:
• send a request to a network policy engine to initiate collection of a first or a second data set from a plurality of network devices, the first data set indicative of the statuses of the plurality of network devices when a type of network attack is not present and the second data set indicative of the statuses of the plurality of network devices when the type of network attack is present;
• receive an authorization from the network policy engine to begin collection of the first or second data set, the authorization based on an evaluation of an impact of collecting the first or second data set on network traffic;
• in response to receiving the authorization from the network policy engine,
• receive the first data set indicative of the statuses of the plurality of network devices when the type of network attack is not present;
• select at least one of the plurality of network devices to simulate the type of network attack by operating as an attacking node;
• and
• receive the second data set indicative of the statuses of the plurality of network devices when the type of network attack is present based on the at least one of the plurality of network devices selected to simulate the type of network attack by operating as an attacking node;
• train a machine learning model using the first and second data set to identify the type of network attack;
• and
• identify a real network attack using the trained machine learning model.

A tangible, non-transitory, computer-readable media having software encoded thereon, the software when executed by a processor operable to:

• send a request to a network policy engine to initiate collection of a first or a second data set from a plurality of network devices, the first data set indicative of the statuses of the plurality of network devices when a type of network attack is not present and the second data set indicative of the statuses of the plurality of network devices when the type of network attack is present;
• receive an authorization from the network policy engine to begin collection of the first or second data set, the authorization based on an evaluation of an impact of collecting the first or second data sets on network traffic;
• in response to receiving the authorization from the network policy engine,
• receive the first data set indicative of the statuses of the plurality of network devices when the type of network attack is not present;
• select at least one of the plurality of network devices to simulate the type of network attack by operating as an attacking node;
• receive the second data set indicative of the statuses of the plurality of network devices when the type of network attack is present based on the at least one of the plurality of network devices selected to simulate the type of network attack by operating as an attacking node;
• train a machine learning model using the first and second data set to identify the type of network attack;
• and
• identify a real network attack using the trained machine learning model.