ADVANCED COMPUTER SYSTEM DRIFT DETECTION

Computer system drift can occur when a computer system or a cluster of computer systems deviates from ideal and/or desired behavior. In a server farm, for example, many different machines may be identically configured to work in conjunction with each other to provide an electronic service (serving web pages, processing electronic payment transactions, etc.). Over time, however, one or more of these systems may drift from previous behavior. Early drift detection can be important, especially in large enterprises, to avoiding costly downtime. Changes in a computer's configuration files, network connections, and/or executable processes can indicate ongoing drift, but collecting this information at scale can be difficult. By using certain hashing and min-Hash techniques, however, drift detection can be streamlined and accomplished for large scale operations. Velocity of drift may also be tracked using a decay function.