1. A method, comprising: receiving, at a device in a network, data flows in a network; providing information relating to the received data flows to a machine learning attack detector that is configured to generate an attack detection indication by analyzing the provided information; and in response to receiving the attack detection indication from the machine learning attack detector, performing a traffic segregation procedure including: computing an anomaly score for each of the received data flows based on a degree of divergence between the data flows and an expected traffic model; determining a subset of the received data flows that have an anomaly score that is lower than or equal to an anomaly threshold value, and providing information relating to the subset of the received data flows to the machine learning attack detector.