An example network system includes processing circuitry and one or more memories coupled to the processing circuitry. The one or more memories are configured to store instructions which, when executed by the processing circuitry, cause the network system to obtain first traffic session metrics data and execute a machine learning model to determine a traffic prediction based on the first traffic session metrics data. The instructions cause the network system to obtain second traffic session metrics data and determine an anomaly in traffic based on a comparison of the traffic prediction and the second traffic session metrics data. The instructions cause the network system to, based on the determination of the anomaly, generate an indication of the anomaly.