Anti-entropy in enterprise networks

A method comprising:

• executing a first node, wherein execution of the first node generates an execution status for the first node and an output data for the first node;
• receiving, by a second node, at least the execution status for the first node and output data for the first node, wherein the first node and the second node are included in a neighbor node set, and both the first node and the second node monitor the first node;
• comparing, by the second node, the received output data to an anomaly policy;
• detecting, by the second node, an anomaly at the first node based on the comparison;
• and
• transmitting an alert in response to the detected anomaly.

A non-transitory, computer readable medium having executable instructions stored therein to perform a method, the method comprising:

• executing a first node, wherein execution of the first node generates an execution status for the first node and an output data for the first node;
• receiving, by a second node, at least the execution status for the first node and output data for the first node, wherein the first node and the second node are included in a neighbor node set, and both the first node and the second node monitor the first node;
• comparing, by the second node, the received output data to an anomaly policy;
• detecting, by the second node, an anomaly at the first node based on the comparison;
• and
• transmitting an alert in response to the detected anomaly.