Patent Document ID: 8959633
Application ID: 13828265
Patent Flag: 1

Claim One:
1. A system for providing access to at least one host machine in a multi-tenant environment, comprising: a plurality of host machines, each host machine including at least one processor and memory for storing instructions executable by the at least one processor; at least one interface component enabling a user device to obtain access to at least one of the plurality of host machines; and a monitoring component in communication with the plurality of host machines, the monitoring component configured to: detect a change with respect to at least one of the host machines; compare information for the change to a behavior baseline to determine whether the change matches an expected behavior; monitor related changes for at least a period of time, when the change does not match an expected behavior, to determine a rate or a prevalence of a type of the change; compare information for the rate or prevalence to at least one corresponding parameter value for baseline to determine whether the rate or prevalence falls within an expected parameter value range; automatically add behavior information for the change to the baseline in response to the rate or prevalence falling within the expected parameter value range; and generate a notification when the rate or prevalence falls outside the expected parameter value range, wherein the expected behavior is one of a plurality of expected behaviors, at least a portion of the expected behaviors being determined based at least in part upon data for purposeful behaviors observed within the plurality of host machines, and wherein at least a portion of the purposeful behaviors are specified by at least one user associated with the plurality of host machines.