Automated malware detection and remediation

A method of analyzing a selected computer, wherein the selected computer is part of a computer network, the method comprising:

• inspecting a predetermined set of operational attributes of the selected computer to detect a change in a state of the selected computer, wherein the inspecting to detect a change in the state of the selected computer is performed by and on the selected computer and wherein a list of the operational attributes is stored by an agent module running on the selected computer;
• in response to a detected change in state, requesting permission from a remote analytic system to conduct a scan of the selected computer by the agent module sending a request to the remote analytic system, the request including an identification of the detected change in state;
• in the remote analytic system, analyzing the detected change in state to determine whether permission to scan the selected computer should be granted, and sending such permission to the agent module when a result of said analyzing so indicates;
• in response to receiving permission from the remote analytic system, scanning the selected computer to create a snapshot of the state of the selected computer;
• transmitting the snapshot from the selected computer to the remote analytic system;
• in the remote analytic system, comparing the snapshot with an aggregated collection of snapshots previously respectively received from a plurality of computers in the computer network, and identifying, in comparison to the aggregated collection of snapshots previously respectively received from the plurality of other computers in the computer network, an anomalous state of the selected computer;
• initiating, from the remote analytic system, a probe of the selected computer to gather additional information related to the anomalous state of the selected computer;
• and
• receiving the additional information and, based thereon, generating a remediation action for the anomalous state of the selected computer.