Abstract: A method of managing devices that monitor and protect a distributed network includes obtaining a peer topology and master-selection rules at each of a plurality of peer devices. A master device at each of the plurality of peer devices is selected using the peer topology and master-selection rules. Device management information and operation information is received at the master. Updated master-selection rules and updated peer topology is obtained. The master sends to each of the plurality of peer devices tasking and task updates. The plurality of peer device reports is generated based on the tasking and is received at the master. A master report is generated based on the plurality of reports. A new master device is selected from the plurality of peer devices based on a determination of whether the master device is disconnected.

Abstract: A method of identifying a device positioned in a network and making domain assignments includes instantiating a network comprising an offsite server and a plurality of trusted devices positioned in at least two different domains. A plurality of local network graphs is generated for at least some of the plurality of trusted devices positioned in the at least two different domains. At least some of the plurality of local network graphs is transmitted to the offsite server. A probability that at least some of the plurality of trusted devices is positioned in the same domain is determined from the plurality of local network graphs. Trusted devices are assigned to domains based upon the determined probabilities. Domain assignments are updated for at least some of the plurality of trusted devices based upon the assignments of trusted devices to the domains.