1. A method, comprising: receiving, at a border router from a network management server (NMS), a set of network properties x i and network performance metrics M i ; intercepting x i and M i transmitted from nodes in a computer network of the border router; building a regression function F based on x i and M i ; and detecting one or more anomalies in the intercepted x i and M i based on the regression function F.