Patent Document ID: 9411955
Application ID: 13964001
Patent Flag: 1

Claim One:
1. A network device comprising: a physical memory; a network access module; and a processor device coupled to the physical memory and the network access module, the processor device configured to: collect interaction data from a plurality of networked units; cluster collected interaction data from different networked units of the plurality of networked units using a clustering method selected based on detectable markers within the interaction data includes determining a number of dimensions corresponding to detectable marker data and selecting a clustering method from a plurality of clustering methods based on the number of dimensions; identify pattern(s) associated with a strain of malware based on observed similarities in the clustered interaction data belonging to at least two networked units of the plurality of networked units; extrapolate a plurality of characteristics of the strain of malware to identify propagation characteristics of the strain of malware and identify at least one other networked unit that is at risk of being infected by the strain of malware; and initiate a proactive response action based on the propagation characteristics of the strain of malware to reduce propagation of the strain of malware, the proactive response action applied to the at least one other networked unit.