Patent ID: 8104087

Claim:
A method for correcting an anomaly in a target computer that is part of a network of computers, the method comprising: determining first corrective data needed to correct the anomaly in the target computer, wherein the target computer is part of the network of computers, the target computer comprising an agent component that is configured to detect the anomaly, wherein the anomaly is identified by: receiving respective snapshots from computers in the network of computers including the target computer, wherein one of the snapshots includes the data having the anomaly; creating an adaptive reference model based at least in part on the respective snapshots, wherein the adaptive reference model is operable to identify statistically significant patterns among the respective snapshots; and comparing at least one of the respective snapshots to the adaptive reference model; sending, using the agent component in the target computer, a request for the first corrective data; locating a donor computer among the plurality of computers in the network, wherein the donor computer includes the first corrective data that is needed to correct the anomaly and wherein the donor computer comprises a same agent component as the target computer; receiving the first corrective data at the target computer from the donor computer; correcting the anomaly in the data stored on the target computer using the first corrective data; receiving, at the target computer a request for second corrective data, wherein the request for second corrective data is sent from the donor computer; and sending, using the agent component in the target computer, the second corrective data for use by the donor computer, such that the target computer acts as a donor computer for purposes of the second corrective data.