Patent ID: 8296850

Claim:
A computer-implemented method for detecting global anomalies associated with a multi-node network of computing devices, the method comprising: generating a reference global profile of a first event class at one or more nodes of the multi-node network, wherein generating the reference global profile of the first class event comprises: determining a probability distribution for a reference event of the first event class, wherein the probability distribution is associated with a number of occurrences of the reference event of the first event class that occur over time at each node of the multi-node network; identifying one or more groups of nodes that have a correlation with the probability distribution for the reference event of the first event class, wherein the one or more groups of nodes include a portion of a total number of nodes in the multi-node network; and generating a reference energy for each of the groups of nodes that correlate with the probability distribution for the reference event of the first event class; generating a detection global profile of the first event class at one or more nodes of the multi-node network, wherein generating the detection global profile of the first class event comprises: determining a probability distribution for a detection event of the first event class, wherein the probability distribution is associated with a number of occurrences of the detection event of the first event class that occur over time at each node in the one or more groups of nodes that have the correlation for the reference event of the first event class; and generating a detection energy for each of the groups of nodes that correlate with the probability distribution for the reference event of the first event class; comparing, at one or more nodes in the multi-node network, the reference energy with the detection energy for each of the groups of nodes having the correlation for the reference event of the first event class; and determining if there is a deviation between the reference global profile and the detection global profile.