An approach for training a recurrent neural network to create a model for anomaly detection in the topology of a network is disclosed. The approach comprises, creating an embedding vector for each resource in the network based on applying an embedding algorithm to each resource of the network. A feature vector is then created for each change to a resource in the network based on one or more properties of the change. A recurrent neural network can thus be trained with the embedding vectors and the feature vectors to create a model for anomaly detection in the topology of the network.