ML Models Intermediate

This lesson covers how to select, build, train, and evaluate machine learning models for common network engineering use cases including traffic prediction, anomaly detection, and capacity planning.

Choosing the Right Model

Building an Anomaly Detection Model

Anomaly detection is one of the most common applications of ML in networking. Here is a practical example using Isolation Forest:

from sklearn.ensemble import IsolationForest
import pandas as pd

# Load network metrics (interface utilization, error rates, etc.)
df = pd.read_csv('network_metrics.csv')
features = ['bytes_in', 'bytes_out', 'errors_in',
            'errors_out', 'latency_ms', 'packet_loss']

# Train Isolation Forest
model = IsolationForest(contamination=0.01, random_state=42)
df['anomaly'] = model.fit_predict(df[features])

# -1 indicates anomaly, 1 indicates normal
anomalies = df[df['anomaly'] == -1]
print(f"Detected {len(anomalies)} anomalous data points")

Model Evaluation for Network Data

Evaluating ML models on network data requires special considerations:

• Time-based splitting - Always split train/test by time, never randomly, to avoid data leakage
• Class imbalance - Anomalies are rare; use precision, recall, and F1-score instead of accuracy
• Operational thresholds - A 99% accurate model that misses 50% of outages is useless. Tune for high recall on critical events
• Concept drift - Network patterns change as the infrastructure evolves. Monitor model performance over time

Traffic Prediction with Time Series

from prophet import Prophet

# Prepare data for Prophet (requires 'ds' and 'y' columns)
traffic = df[['timestamp', 'bandwidth_mbps']].rename(
    columns={'timestamp': 'ds', 'bandwidth_mbps': 'y'})

# Train model with daily and weekly seasonality
model = Prophet(daily_seasonality=True, weekly_seasonality=True)
model.fit(traffic)

# Forecast next 7 days
future = model.make_future_dataframe(periods=7*24, freq='H')
forecast = model.predict(future)