Patent ID: 11876815
Assignee: MCAFEE, LLC
Field: Digital communication (Electrical engineering)
Classification: CPC H | IPC H

Claim 9:
10. One or more tangible, non-transitory computer readable storage media having stored thereon executable instructions to instruct a processor to:
receive, from a cloud service, a plurality of machine-learning based assigned classes for a host device, respective host device parameters for the assigned classes, and global trend lines for the assigned classes;
periodically collect local telemetry relevant to the respective host device parameters;
compute local device-specific class-specific historical trend lines for the assigned classes, wherein the local device-specific class-specific historical trend lines comprise a difference between local resource usage for a class, based on the local telemetry, and global resource usage for the class, based on the global trend line for the class;
detect an anomaly, comprising determining that a recent usage trend line for a class under analysis deviates substantially from a device-specific class-specific historical trend line for the class under analysis; and
based on detecting the anomaly, notify a user of the host device, or a security administrator, of the anomaly, including when the anomaly occurred and which host device parameters experienced the anomaly.