ORGANIZATION SEGMENTATION FOR ANOMALY DETECTION

A method of detecting and handling anomalies in a network, including, collecting meta-data related to an environment of each organization using the network; wherein each organization deploys one or more computers connected to the network, extracting features from the meta-data, clustering organizations having common features into segments, collecting training data from all organizations, grouping the training data according to the segments, training a model for each segment with event data to detect and handle anomalies, analyzing event data of a segment with a respective model for that segment, providing a decision score responsive to the analyzing; and handling the anomaly based on the decision score.