Automated identification of anomalous devices
Disclosed are various approaches for automating the detection and identification of anomalous devices in a management service. Device check-ins are received by a management service and housed in a data store. The quantity of device check-ins over various time periods can be analyzed using various approaches to identify anomalous devices.
1. A system, comprising:
a computing device comprising a processor and a memory, the computing device executing a management service that manages a plurality of client devices; and
machine-readable instructions stored in the memory that, when executed by the processor, cause the computing device to at least:
obtain a plurality of device check-ins associated with the plurality of client devices over a first time period;
obtain a set of device check-ins corresponding to the first time period, wherein respective ones of the device check-ins correspond to respective ones of the client devices;
calculate a variance of the set of device check-ins based on a quantity of device check-ins that correspond to individual client devices;
identify an anomalous device based upon the quantity of device check-ins for the anomalous device exceeding a variance threshold, wherein the variance threshold is based upon a variance factor, the variance factor comprising at least 1.5 times an average variance of the set of device check-ins; and
publish a notification to a notification channel in response to identifying the anomalous device.
2. The system of claim 1 , wherein the machine-readable instructions further cause the computing device to at least obtain a response in the notification channel to perform a remedial action with respect to the anomalous device.
3. The system of claim 2 , wherein the machine-readable instructions that cause the computing device to perform the remedial action further cause the computing device to at least perform the remedial action in response to a reply received from an admin device associated with an administrative user.
4. The system of claim 1 , wherein the machine-readable instructions further cause the computing device to at least identify the anomalous device based upon an analysis of a second time period that is greater than the first time period.
5. The system of claim 1 , wherein the machine-readable instructions further cause the computing device to at least execute a long short-term memory forecaster to detect a quantity of device check-ins in a subsequent time period based upon a historical log of device check-ins.
6. A method, comprising:
obtaining a plurality of device check-ins associated with a plurality of client devices over a first time period;
obtaining a set of device check-ins corresponding to the first time period, wherein respective ones of the device check-ins correspond to respective ones of the client devices;
calculating a variance of the set of device check-ins based on a quantity of device check-ins that correspond to individual client devices;
identifying an anomalous device based upon the quantity of device check-ins for the anomalous device exceeding a variance threshold, wherein the variance threshold is based upon a variance factor, the variance factor comprising at least 1.5 times an average variance of the set of device check-ins; and
publishing a notification to a notification channel in response to identifying the anomalous device.
7. The method of claim 6 , further comprising obtaining a response in the notification channel to perform a remedial action with respect to the anomalous device.
8. The method of claim 7 , wherein performing the remedial action further comprises performing the remedial action in response to a reply received from an admin device associated with an administrative user.
9. The method of claim 6 , further comprising identifying the anomalous device based upon an analysis of a second time period that is greater than the first time period.
10. The method of claim 6 , further comprising identifying the anomalous device based upon an analysis of a second time period that is greater than the first time period, wherein the anomalous device is associated with the quantity of device check-ins that is less than the variance threshold, and the anomalous device is detected by being associated with more than one time period of an elevated quantity of device check-ins.
11. The method of claim 6 , further comprising executing a long short-term memory forecaster to detect a quantity of device check-ins in a subsequent time period based upon a historical log of device check-ins.
12. A non-transitory, computer-readable medium comprising machine-readable instructions that, when executed by a processor, cause a computing device to at least:
obtain a plurality of device check-ins associated with a plurality of client devices over a first time period;
obtain a set of device check-ins corresponding to the first time period, wherein respective ones of the device check-ins correspond to respective ones of the client devices;
calculate a variance of the set of device check-ins based on a quantity of device check-ins that correspond to individual client devices;
identify an anomalous device based upon the quantity of device check-ins for the anomalous device exceeding a variance threshold, wherein the variance threshold is based upon a variance factor, the variance factor comprising at least 1.5 times an average variance of the set of device check-ins; and
publish a notification to a notification channel in response to identifying the anomalous device.
13. The non-transitory, computer-readable medium of claim 12 , wherein the machine-readable instructions further cause the computing device to at least obtain a response in the notification channel to perform a remedial action with respect to the anomalous device.
14. The non-transitory, computer-readable medium of claim 13 , wherein the machine-readable instructions that cause the computing device to perform the remedial action further cause the computing device to at least perform the remedial action in response to a reply received from an admin device associated with an administrative user.
15. The non-transitory, computer-readable medium of claim 12 , wherein the machine-readable instructions further cause the computing device to at least identify the anomalous device based upon an analysis of a second time period that is greater than the first time period, wherein the anomalous device is associated with the quantity of device check-ins that is less than the variance threshold, and the anomalous device is detected by being associated with a cluster of other devices causing an elevated quantity of device check-ins.
16. The non-transitory, computer-readable medium of claim 12 , wherein the machine-readable instructions further cause the computing device to at least identify the anomalous device based upon an analysis of a second time period that is greater than the first time period, wherein the anomalous device is associated with the quantity of device check-ins that is less than the variance threshold, and the anomalous device is detected by being associated with more than one time period of an elevated quantity of device check-ins.