Patent ID: 8117486
Filing Date: 2012-02-14
Classification: H04L

Abstract:
1. A method for detecting one or more anomalous devices, the method comprising: for each of a plurality of devices, receiving, from the device, semi-structured system registry data corresponding to one or more applications on the device; for each pair of devices of the plurality of devices, determining a similarity measurement between first semi-structured system registry data from a first device of the pair of devices and second semi-structured system registry data from a second device of the pair of devices by: clustering the devices based on the determined similarity measurements to form one or more device clusters; identifying one or more outliers based on the clustering, wherein an outlier represents an anomalous device that is part of a cluster that has a small number of devices as compared to other clusters; and performing one or more remedial actions for the one or more identified anomalous devices.