Patent ID: 11876815
Assignee: MCAFEE, LLC
Field: Digital communication (Electrical engineering)
Classification: CPC H | IPC H

Claim 0:
1. A computing apparatus, comprising:
a hardware platform comprising a processor circuit and a memory; and
an anomaly detection engine comprising instructions encoded within the memory to instruct the processor circuit to:
receive, from a cloud service, a plurality of machine learning-derived device classes that the computing apparatus belongs to, respective device use parameters specific to the device classes, and respective global trend lines for the device classes;
periodically collect local telemetry for the device use parameters, and compute device-specific class-specific historical trendlines, wherein the device-specific class-specific historical trendlines comprises a difference between local resource usage for a class, based on the local telemetry, and global resource usage for the class based on the global trend line for the class;
detect an anomaly comprising determining consumption of the device use parameters for a device-specific class-specific recent usage trend line, and determining that the device-specific class-specific recent usage trend line deviates substantially from the device-specific class-specific historical trend line for the class; and
based on detecting the anomaly, notify a user of the computing apparatus, or a security administrator, of the anomaly, including when the anomaly occurred and which resources experienced the anomaly.