1. A system for detecting abnormal system states in computers, comprising: a plurality of software agents respectively residing on a plurality of computers within a population of computers, the software agents generating snapshots that include data indicating the state of the respective computers; and an analytic component operable to automatically generate an adaptive reference model comprising a rule set customized to characteristics of the population of computers, the rule set being developed by identifying patterns among the snapshots from the plurality of computers such that the adaptive reference model is indicative of normal states in the computers within the population, wherein the analytic component compares a snapshot from at least one of the computers to the adaptive reference model to determine whether an anomaly is present in the state of the least one of the computers.