Patent ID: 11924230
Assignee: LOOKOUT, INC.
Field: Digital communication (Electrical engineering)
Classification: CPC H  G  Y | IPC G  H

Claim 15:
16. A method comprising:
at a server, distributing first policies to a plurality of devices, the plurality of devices includes a first device;
at a server, receiving, from the plurality of devices, observation data responsive to the first policies for observation data, the received observation data including information associated with at least one of: device configuration, device state, or device behavior;
at the server, determining a normal pattern of activity occurring on the plurality of devices using the received observation data, the normal pattern of activity being associated with at least one of: the device configuration, the device state, or the device behavior, of the plurality of devices;
at the server, receiving first device data from a first device of the plurality of devices, the first device data being received according to a second policy formulated in response to the normal pattern of activity occurring on the plurality of devices;
at the server, determining a first pattern of activity occurring on the first device using the received first device data;
at the server, comparing the normal pattern of activity with the first pattern of activity occurring on the first device;
at the server, determining that the first pattern of activity deviates from the normal pattern of activity beyond a threshold value; and
upon the determination, transmitting by the server, the second policy to the first device to replace the first policy distributed to the first device.