Patent ID: 8549003
Filing Date: 2013-10-01
Classification: G06F,H04L

Abstract:
1. A computer implemented method, executed by one or more processors comprising: obtaining a plurality of host file inventories corresponding respectively to a plurality of hosts in a network environment, wherein each of the plurality of host file inventories includes one or more file identifiers, each of the file identifiers of a particular host file inventory representing a different executable file on one of the plurality of hosts corresponding to the particular host file inventory; calculating input data by transforming the plurality of host file inventories into a matrix of keyword vectors in Euclidean space based on a keyword sequence, wherein each keyword of the keyword sequence is unique, wherein each one of the plurality of hosts corresponds to one of the keyword vectors; and providing the input data to a clustering procedure to group the plurality of hosts into one or more clusters of hosts, wherein the one or more clusters of hosts are grouped using a predetermined similarity criteria.