Patent Document ID: 9961096
Application ID: 14489152
Patent Flag: 1

Claim One:
1. A system for detecting anomalies, the system comprising: a memory and at least one processor operatively connected to at least one database, wherein the at least one processor is configured for: receiving one or more behavioral vector parameters for each of a plurality of metrics from one or more users; creating a plurality of individual and independent behavioral vectors, wherein each behavioral vector of the plurality of individual and independent behavioral vectors is for a respective metric of the plurality of metrics and is created based on the received one or more behavioral vector parameters for the respective metric of the plurality of metrics, and each behavioral vector of the plurality of individual and independent behavioral vectors comprises identifiers of a plurality of subject computing devices, the respective metric of the plurality of metrics, and an interval; creating a plurality of baselines, wherein each baseline of the plurality of baselines is for a particular behavioral vector of the plurality of individual and independent behavioral vectors and comprises an expected value for the respective metric of the plurality of metrics collected over the interval, the expected value for the respective metric of the plurality of metrics being determined based on data associated with the particular behavioral vector of the plurality of individual and independent behavioral vectors; transmitting the plurality of individual and independent behavioral vectors and the plurality of baselines to a plurality of sensors, wherein each sensor of the plurality of sensors is associated with a particular subject computing device of the plurality of subject computing devices, and wherein the particular subject computing device of the plurality of subject computing devices is associated with a user of the one or more users; and receiving, from each sensor of the plurality of sensors, a result comprising an observed value for one or more metrics of the plurality of metrics collected over the interval at the particular subject computing device of the plurality of subject computing devices and a comparison, for each of the one or more metrics of the plurality of metrics collected over the interval, of the observed value and the expected value, wherein the comparison identifies a behavioral anomaly at the particular subject computing device of the plurality of subject computing devices.