In some examples, a method is described. The method can, for example be performed by a network switch and can include receiving instructions to monitor a switch resource, monitoring time-series data for traffic received and transmitted by the switch, identifying peaks for the switch resource in a specified time period for the monitored data, comparing the identified peaks with data provided during a training phase to identify whether the monitored data includes an anomaly, and generating an alert when the data is identified as containing an anomaly.