US Patent 9961096 Distributed behavior based anomaly detection

Systems and methods for detecting behavior-based anomalies are described herein. In various embodiments, the system includes a context engine for creating behavioral vectors that are transmitted to a long term data store, to behavioral engines configured to create baselines based on historical data, and to sensors configured to observe system resources. According to particular embodiments, the system is configured to collect data regarding the system resources (e.g., via the sensors) and compare the collected data to baselines to determine whether anomalies have occurred.