Patent ID: 8914500

Claim:
A computerized method of creating a classifier model, the method comprising: receiving, at a processing circuit, a first list of network device identifiers and a second list of network device identifiers that are not on the first list of network device identifiers, the first list of network device identifiers including data characteristic of network activity performed at a device associated with the network device identifier including a time period at which a network activity was performed; designating, by the processing circuit, a time period of interest to the classifier model; identifying, by the processing circuit, a first category of network activities that includes at least one network activity performed by a device associated with a network device identifier on the first list of network device identifiers within the designated time period; identifying, by the processing circuit, a second category of network activities that includes at least one network activity performed at any time period by network device identifiers on the second list of network device identifiers; identifying, by the processing circuit, a third category of network activities that includes at least one network activity performed by network device identifiers on the first list of network device identifiers at a time outside of the designated time period, the second category of network activities and the third category of network activities represent examples of data characteristic of network activity performed at a device associated with a network device identifier that should not be added to the list of similar network device identifiers; generating, by the processing circuit, the classifier model based on the first, second and third categories of network activities; and adding, by the processing circuit, a second network device identifier to a list of similar network device identifiers based on the generated classifier model, the list of similar network device identifiers comprising network device identifiers that are not on the first list of network device identifiers.