Abstract: A method and apparatus for configuring an anomaly detector by constructing a classifier using supervised learning and applying that classifier to classify M2M traffic as either “anomalous” or “non-anomalous” with respect to a particular host. Anomaly detection is provided using one or more constructed classifiers. Each classifier is akin to an object that supports two main operations: (1) train: given a set of labeled feature vectors, construct a classifier; and (2) classify: given a feature vector, output a particular classification (i.e., result) selected from two classes defined as anomalous or non-anomalous. A non-anomalous result is indicative of host flow data that is typically associated with a particular host (i.e., safe traffic). An anomalous result is indicative of host flow data that is not typically associated with a particular host (i.e., unsafe traffic).