Anomaly detection using network metadata