1. A system, comprising: a plurality of networked units; at least one detection and classification unit comprising a physical memory, a processor, and a network access module; the at least one detection and classification unit being configured to: collect interaction data from the plurality of networked units; cluster collected interaction data of at least two networked units; identify pattern(s) based on observed similarities in the clustered interaction data; and make a security determination based at least in part on the identified pattern(s).