Patent Document ID: 9686292
Application ID: 14734822
Patent Flag: 1

Claim One:
1. A method for correcting a deviating network device of a plurality of network devices using a programmed response based on a measure of significance of a detected deviation from a predicted future device behavior based on a corresponding network device history of matching device profiles and a corresponding history of device profile transitions for the deviating network device, the method, employing a processing device and a data storage device, comprising: storing, by the data storage device, for a first network device, a matching device profile history and a device profile transition history; storing, by the data storage device, for a second network device, a matching device profile history and a device profile transition history, wherein matching device profile histories and device profile transition histories differ according to a device type of each of the plurality of network devices and wherein the matching device profile history and device profile transition history for the first network device differ from the match device profile history and device profile transition history for the second network device; receiving, by the processing device, from the plurality of network devices, over one or more first observation periods, a plurality of network traffic for each of the first and the second network devices; determining, using the plurality of network traffic, a first device profile from the plurality of network traffic; comparing, by the processing device, the first device profile to each of the matching device profile histories for the first network device and the second network device; matching, by the processing device, the first device profile to matching device profiles of the first network device and the second network device, wherein a first matching device profile for the first network device differs from a first matching device profile for the second network device; monitoring, by the processing device, over one or more second observation periods, the plurality of network traffic of the one of the first network device or the second network device for a device profile transition, wherein the device profile transition comprises a device profile transition from the first matching device profile for the respective network device to a second matching device profile for the respective network device; comparing, by the processing device, the monitored device profile transition to the corresponding device profile transition history of the one of the first network device or the second network device; predicting, by the processing device, future device behavior of the one of the first network device or the second network device, based on the comparison; detecting a deviation from predicted future device behavior for the one of the first network device or the second network device; and correcting, using the programmed response, the detected deviation for the one of the first network device or the second network device.