Back to results
US 2023/0275918 A1Published application
Automated identification of anomalous devices
AssigneeVMware, Inc.
InventorsKar-Fai Tse, Chaoting Xuan, Ravish Chawla, Erich Stuntebeck, Stephen Jonathan Parry-Barwick
Life of this patent
Estimating the term…
Abstract
Disclosed are various approaches for automating the detection and identification of anomalous devices in a management service. Device check-ins are received by a management service and housed in a data store. The quantity of device check-ins over various time periods can be analyzed using various approaches to identify anomalous devices.
Claims20
A system, comprising:
- a computing device comprising a processor and a memory, the computing device executing a management service that manages a plurality of client devices;
- and
- machine-readable instructions stored in the memory that, when executed by the processor, cause the computing device to at least:
- obtain a plurality of device check-ins associated with the plurality of client devices over a first time period;
- obtain a set of device check-ins corresponding to the first time period, wherein respective ones of the device check-ins correspond to respective ones of the client devices;
- calculate a variance of the set of device check-ins based on a quantity of device check-ins that correspond to individual client devices;
- identify an anomalous device based upon the quantity of device check-ins for the anomalous device exceeding a variance threshold;
- and
- publish a notification to a notification channel in response to identifying the anomalous device.
6 more elements
A method, comprising:
- obtaining a plurality of device check-ins associated with a plurality of client devices over a first time period;
- obtaining a set of device check-ins corresponding to the first time period, wherein respective ones of the device check-ins correspond to respective ones of the client devices;
- calculating a variance of the set of device check-ins based on a quantity of device check-ins that correspond to individual client devices;
- identifying an anomalous device based upon the quantity of device check-ins for the anomalous device exceeding a variance threshold, wherein the variance threshold is based upon a variance factor, the variance factor comprising at least 1.5 times an average variance of the set of device check-ins;
- and
- publishing a notification to a notification channel in response to identifying the anomalous device.
3 more elements
A non-transitory, computer-readable medium comprising machine-readable instructions that, when executed by a processor, cause a computing device to at least:
- obtain a plurality of device check-ins associated with a plurality of client devices over a first time period;
- obtain a set of device check-ins corresponding to the first time period, wherein respective ones of the device check-ins correspond to respective ones of the client devices;
- calculate a variance of the set of device check-ins based on a quantity of device check-ins that correspond to individual client devices;
- identify an anomalous device based upon the quantity of device check-ins for the anomalous device exceeding a variance threshold, wherein the variance threshold is based upon a variance factor, the variance factor comprising at least 1.5 times an average variance of the set of device check-ins;
- and
- publish a notification to a notification channel in response to identifying the anomalous device.
3 more elements
Dependencies are inferred from the claim text.