A method performed by a fabric controller, said method comprising: performing a first anomaly detection process to determine anomalies between a plurality of switches having the same roles, in order to find out if any one of the plurality of switches is behaving anomalously when compared to other switches of the plurality of switches (202, 204), wherein the plurality of switches having the same roles comprise either spine switches or leaf switches; performing a second anomaly detection process to determine if any anomalies exist between historic patterns of a given switch of the plurality of switches; and determining the existence of an anomaly at the given switch upon detecting an anomaly for the given switch in both the first and the second anomaly detection processes; wherein performing any of the first and the second anomaly detection processes comprises: collecting data sample points to form a first data set, each of the data sample points representing one of a plurality of network feature variables, each of the plurality of network feature variables associated with a corresponding network feature of a plurality of network features, the plurality of network features occurring at the given switch in case of the second anomaly detection process and between the switches having the same roles in case of the first anomaly detection process; calculating a standard deviation and a mean value of the plurality of network feature variables for each of the plurality of network features; performing normalization of the plurality of network feature variables to obtain normalized network feature variables; calculating, using the standard deviation and the mean value for each network feature, a probability value, p-value, for each of the normalized network feature variables; and determining if an anomaly exists with respect to each of the plurality of network features based at least upon the p-value for each of the normalized network feature variables. performing a first anomaly detection process to determine anomalies between a plurality of switches having the same roles, in order to find out if any one of the plurality of switches is behaving anomalously when compared to other switches of the plurality of switches (202, 204), wherein the plurality of switches having the same roles comprise either spine switches or leaf switches; performing a second anomaly detection process to determine if any anomalies exist between historic patterns of a given switch of the plurality of switches; and determining the existence of an anomaly at the given switch upon detecting an anomaly for the given switch in both the first and the second anomaly detection processes; wherein performing any of the first and the second anomaly detection processes comprises: collecting data sample points to form a first data set, each of the data sample points representing one of a plurality of network feature variables, each of the plurality of network feature variables associated with a corresponding network feature of a plurality of network features, the plurality of network features occurring at the given switch in case of the second anomaly detection process and between the switches having the same roles in case of the first anomaly detection process; calculating a standard deviation and a mean value of the plurality of network feature variables for each of the plurality of network features; performing normalization of the plurality of network feature variables to obtain normalized network feature variables; calculating, using the standard deviation and the mean value for each network feature, a probability value, p-value, for each of the normalized network feature variables; and determining if an anomaly exists with respect to each of the plurality of network features based at least upon the p-value for each of the normalized network feature variables. collecting data sample points to form a first data set, each of the data sample points representing one of a plurality of network feature variables, each of the plurality of network feature variables associated with a corresponding network feature of a plurality of network features, the plurality of network features occurring at the given switch in case of the second anomaly detection process and between the switches having the same roles in case of the first anomaly detection process; calculating a standard deviation and a mean value of the plurality of network feature variables for each of the plurality of network features; performing normalization of the plurality of network feature variables to obtain normalized network feature variables; calculating, using the standard deviation and the mean value for each network feature, a probability value, p-value, for each of the normalized network feature variables; and determining if an anomaly exists with respect to each of the plurality of network features based at least upon the p-value for each of the normalized network feature variables.