Patent ID: 9571512
Date: 2017-02-14
CPC Classifications: H04L

Claim:
1. A method comprising: selecting a metric that objectively and quantitatively characterizes an endpoint property, the metric representing changes made to files on the endpoint; monitoring a change in the metric on a group of endpoints over time; creating a model that evaluates whether a new value for the metric at a point in time is within a range of expected values for the metric at the point in time, the model including a statistical model based on a variance that characterizes a range of expected values, and a periodicity that characterizes a change in the range of expected values over time: instrumenting an endpoint to detect a current value for the metric at a current time; applying the model to determine whether the current value is within the range of expected values for the metric at the current time; and implementing a remedial action for the endpoint when the current value is not within the range of expected values for the metric at the current time.