Differencing engine for digital forensics

One or more non-transitory computer readable media including instructions that, when executed by one or more processors, cause the one or more processors to perform the steps of:

• acquiring a first plurality of snapshots for a first instance group using a first set of queries, wherein each snapshot represents a current operational state of a different host instance included in the first instance group;
• executing a clustering algorithm based on the first plurality of snapshots to generate a first plurality of clusters;
• and
• determining that a first host instance included in the first instance group is operating in an anomalous fashion based on a first cluster included in the first plurality of clusters that is associated with fewer host instances than at least a second cluster included in the first plurality of clusters.

A system comprising:

• one or more memories storing instructions;
• and
• one or more processors that are coupled to the one or more memories and, when executing the instructions, are configured to:
• acquire a plurality of snapshots for an instance group, wherein each snapshot includes responses from a different host instance included in the instance group to one or more queries;
• perform one or more clustering operations based on the plurality of snapshots to generate a plurality of clusters;
• and
• determine that a first host instance included in the instance group is operating in an anomalous fashion based on a first cluster included in the plurality of clusters that is associated with fewer host instances than at least a second cluster included in the plurality of clusters.