1. A system for detecting abnormal system states in computers, comprising: a collector component configured to receive a plurality of snapshots that include data indicating the state of respective computers within a population of computers; and an analytic component operable to automatically generate an adaptive reference model comprising a rule set customized to characteristics of the population of computers, the rule set being developed by identifying patterns among the snapshots from the plurality of computers such that the adaptive reference model is indicative of normal states in the computers within the population, wherein the analytic component compares a snapshot from at least one of the computers to the adaptive reference model to determine whether an anomaly is present in the state of the least one of the computers.