Patent Document ID: 8973133
Application ID: 13720843
Patent Flag: 1

Claim One:
1. A computer-implemented method for detecting abnormal behavior of networked devices, at least a portion of the method being performed by a computing device comprising at least one processor, the method comprising: identifying a purpose-built device expected to have a predictable pattern of behavior on a network; determining a baseline pattern of behavior of the purpose-built device, wherein determining the baseline pattern of behavior of the purpose-built device comprises determining a type of the purpose-built device and, based on the type of the purpose-built device, querying an observation database populated with at least one observation of baseline behavior of at least one of a plurality of purpose-built devices of the type; monitoring the network to detect a behavior of the purpose-built device; comparing the behavior to the baseline pattern of behavior of the purpose-built device in order to determine that the behavior comprises an abnormal behavior.