1. A computer-executed method for identifying undesirable features in a network of computing nodes, comprising: detecting an anomaly associated with a node in the network; identifying features which is associated with the anomaly; updating the identified features; communicating the updated features to at least one other node in the network; receiving information indicating a correlation between a feature and the anomaly from at least one other node in the network; correlating the feature with the anomaly based on the received information; and producing a result which indicates a correlation between the feature and the anomaly.