Novel tools and techniques for the machine discovery of aberrant states are provided. A system includes a plurality of network devices, and a decision system in communication with the plurality of network devices. Each of the plurality of network devices may be configured to generate a respective data stream. The decision system may include a processor and a non-transitory computer readable medium including instructions executable by the processor to obtain, via the plurality of network devices, one or more data streams. The decision system may build a historic model of a data stream, and determine a predicted value of the data stream at a future time, based on the historic model. The decision system may be configured to determine whether an anomaly has occurred based on a variation between a current value of the data stream and the predicted value of the data stream.