Patent Document ID: 10164991
Application ID: 15176652
Patent Flag: 1

Claim One:
1. A method comprising: maintaining, at a device in a network, a plurality of anomaly detection models for different sets of aggregated traffic data regarding traffic in the network; determining, by the device, a measure of confidence in a particular one of the anomaly detection models that evaluates a particular set of aggregated traffic data; dynamically replacing, by the device, the particular anomaly detection model with a second anomaly detection model configured to evaluate the particular set of aggregated traffic data and has a different model capacity than that of the particular anomaly detection model; providing, by the device, an anomaly event notification to a supervisory controller based on a combined output of the second anomaly detection model and of one or more of the anomaly detection models in the plurality of anomaly detection models; assigning, by the device, a selected first anomaly detection model from the plurality of anomaly detection models to a competition bucket group; determining, by the device, an anomaly detection score using the selected first anomaly detection model assigned to the competition bucket group; and including, by the device, the anomaly detection score in a report of most anomalous scores associated with the competition bucket group.