Feedback loop closed

endpoint joins network
controller tasked to mirror traffic to ML
ML makes evaluation
evaluation compared to DB entry
stop mirroring
if (current eval != old eval)
shutdown port