Patent ID: 8117486

Claim:
A method for detecting one or more anomalous devices, the method comprising: for each of a plurality of devices, receiving, from the device, semi-structured system registry data corresponding to one or more applications on the device; for each pair of devices of the plurality of devices, determining a similarity measurement between first semi-structured system registry data from a first device of the pair of devices and second semi-structured system registry data from a second device of the pair of devices by: compressing the first semi-structured system registry data and the second semi-structured system registry data, determining a first size associated with the compressed first semi-structured system registry data, determining a second size associated with the compressed second semi-structured system registry data, concatenating the first semi-structured system registry data and the second semi-structured system registry data to create concatenated semi-structured system registry data, and determining the similarity measurement by determining a ratio of a size of the concatenated semi-structured system registry data and a sum of the first size and the second size; clustering the devices based on the determined similarity measurements to form one or more device clusters; identifying one or more outliers based on the clustering, wherein an outlier represents an anomalous device that is part of a cluster that has a small number of devices as compared to other clusters; and performing one or more remedial actions for the one or more identified anomalous devices.