Method for identifying undesirable features among computing nodes

One embodiment of the present invention provides a system for identifying undesirable features in a network of computers. During operation, the system detects an anomaly associated with a node in the network. Next, the system identifies one or more features which are associated with the anomaly. The system then updates the identified features. Next, the system communicates the information corresponding to updated features to at least one other node in the network. The system then receives information indicating a correlation between the updated features and the anomaly from at least one other node in the network. Next, the system correlates the updated features with the anomaly based on the received information. The system subsequently produces a result which indicates a correlation between the updated features and the anomaly.