nassimsai/anomaly-detector repository overview

⁠Anomaly Detector — NetworkPolicy Intelligence System

Part of the NetworkPolicy Intelligence System (NPI)⁠.

⁠What it does

Polls flow_baseline every 30 seconds and runs three complementary detection tiers:

1. Statistical (Z-score) — Welford-derived mean/stddev per flow key, flags MEDIUM/HIGH deviations from baseline traffic volume
2. Deterministic rules — known-bad patterns (e.g. port-scan signatures, unexpected cross-namespace flows)
3. Machine Learning (Isolation Forest, scikit-learn) — multivariate outlier detection across flow features, catches anomalies the univariate Z-score tier misses

Findings are written to the anomaly_events hypertable and routed to Prometheus AlertManager and the LLM Service for natural-language explanation.

⁠Tech

Python 3.11 · scikit-learn (IsolationForest) · NumPy · psycopg2 · TimescaleDB

⁠Quick start

docker pull nassimsai/anomaly-detector:v1.0-pfe2026

Requires: DATABASE_URL env var.

⁠Source & full deployment guide

https://github.com/nassim-saii/netpol-intelligence⁠