A computer-implemented method comprising: receiving behavior data and line parameter data from a plurality of user devices (106, 107; 210) in real-time associated with a plurality of communication lines (130, 132), each user device being associated with a respective communication line, wherein the behavior data includes information regarding bandwidth usage and utilization time frames, and the line parameter data includes information regarding the respective communication line and the devices that access the respective communication line including device availability, line availability, boot times, link retrains, bit rates upstream and downstream, central processing unit load and signal noise margin ratio; training a predictive model using a set of training data to discover correlations, wherein the training data is received behavior data and received line parameter data for a subset of the plurality of user devices and a subset of the plurality of communication lines for a particular temporal interval, and wherein at least one correlation indicates that the probability of a network anomaly grows with an increasing number of reboots, line drops or bitrate upstream/downstream, and wherein at least one correlation indicates that the probability of a network anomaly decreases when central processing unit load, signal noise margin ratio or line availability increases; processing received behavior data and line parameter data through the predictive model; continually tuning the predictive model; providing a risk score for each communication line of the plurality of communication lines based on the processing, each risk score representing a likelihood of a network anomaly for the respective communication line would occur within a determined temporal period; selectively performing test recovery actions for multiple communication lines based on respective risk scores, the test recovery actions being performed to inhibit occurrence of network anomalies, wherein selectively performing the test recovery actions includes dividing communication lines from the plurality of communication lines into subsets and applying different test recovery actions to different subsets of communications lines, wherein the test recovery actions include device reboots, upgrades and inventory updates, and wherein the communication lines are ordered according to the respective risk scores, and wherein the test recovery actions are selectively performed based on the respective risk score meeting a determined threshold; and measuring an effect that each test recovery action has on a respective risk score for respective communication line. receiving behavior data and line parameter data from a plurality of user devices (106, 107; 210) in real-time associated with a plurality of communication lines (130, 132), each user device being associated with a respective communication line, wherein the behavior data includes information regarding bandwidth usage and utilization time frames, and the line parameter data includes information regarding the respective communication line and the devices that access the respective communication line including device availability, line availability, boot times, link retrains, bit rates upstream and downstream, central processing unit load and signal noise margin ratio; training a predictive model using a set of training data to discover correlations, wherein the training data is received behavior data and received line parameter data for a subset of the plurality of user devices and a subset of the plurality of communication lines for a particular temporal interval, and wherein at least one correlation indicates that the probability of a network anomaly grows with an increasing number of reboots, line drops or bitrate upstream/downstream, and wherein at least one correlation indicates that the probability of a network anomaly decreases when central processing unit load, signal noise margin ratio or line availability increases; processing received behavior data and line parameter data through the predictive model; continually tuning the predictive model; providing a risk score for each communication line of the plurality of communication lines based on the processing, each risk score representing a likelihood of a network anomaly for the respective communication line would occur within a determined temporal period; selectively performing test recovery actions for multiple communication lines based on respective risk scores, the test recovery actions being performed to inhibit occurrence of network anomalies, wherein selectively performing the test recovery actions includes dividing communication lines from the plurality of communication lines into subsets and applying different test recovery actions to different subsets of communications lines, wherein the test recovery actions include device reboots, upgrades and inventory updates, and wherein the communication lines are ordered according to the respective risk scores, and wherein the test recovery actions are selectively performed based on the respective risk score meeting a determined threshold; and measuring an effect that each test recovery action has on a respective risk score for respective communication line.