Patent ID: 11924230
Assignee: LOOKOUT, INC.
Field: Digital communication (Electrical engineering)
Classification: CPC H  G  Y | IPC G  H

Claim 0:
1. A method comprising:
at a server, according to a first data collection policy, collecting observation data from a plurality of devices, the collected observation data including information associated with at least one of: device configuration, device state, or device behavior;
at the server, determining a normal pattern of activity occurring on the plurality of devices by processing the collected observation data, the normal pattern of activity being associated with at least one of: the device configuration, the device state, or the device behavior, of the plurality of devices;
at the server, creating a second data collection policy using the determined normal pattern of activity occurring on the plurality of devices, the second data collection policy being different from the first data collection policy;
at the server, according to the second data collection policy, collecting first device data from a first device of the plurality of devices;
at the server, comparing the normal pattern of activity occurring on the plurality of devices with a first pattern of activity occurring on the first device, the first pattern of activity being determined using the first device data;
at the server, determining that a deviation between the normal pattern of activity and the first pattern of activity associated with the first device is beyond a threshold deviation; and
upon the determination, sending alert information by the server, wherein the alert information initiates performance of an action on the first device.