Abstract: A system includes one or more memories, and model generation circuitry coupled to the one or more memories, wherein the model generation circuitry is configured to: determine a plurality of decision trees, wherein each decision tree is associated with a corresponding network whose attribute data, including interface statistics, is used for training a trained model and includes one or more decision nodes for indicating whether the corresponding network includes a rogue network device; aggregate the plurality of decision trees to generate the trained model; and output the trained model for rogue network device detection.