1. One or more non-transitory media including code for execution that, when executed by a processor, is operable to: obtain a plurality of host file inventories corresponding respectively to a plurality of hosts in a network environment; calculate input data by transforming the plurality of host file inventories into a similarity matrix for the plurality of hosts; and provide the input data to a clustering procedure to group the plurality of hosts into one or more clusters of hosts, wherein the one or more clusters of hosts are grouped using a predetermined similarity criteria.