1. A method, comprising: analyzing, by a device in a network, data indicative of a behavior of the network using a supervised anomaly detection model; determining, by the device, whether the supervised anomaly detection model detected an anomaly in the network from the analyzed data; and training, by the device, an unsupervised anomaly detection model, based on a determination that no anomalies were detected by the supervised anomaly detection model.