Patent Document ID: 9690645
Application ID: 14649183
Patent Flag: 1

Claim One:
1. A computer program product for determining suspected root causes of anomalous network behavior, comprising: a non-transitory computer readable storage medium, said non-transitory computer readable storage medium comprising computer readable program code embodied therewith, said computer readable program code comprising program instructions that, when executed, causes a processor to: identify anomalous components in a network exhibiting anomalous behavior from a plurality of network components; assign a likelihood score to said network components based on a scoring policy that considers recent change events affecting said anomalous components, wherein said scoring policy includes at least one of a frequency factor that considers how often a selected change event occurs within said network, a duration factor that considers a time duration between an occurrence of a selected change event and a beginning of said anomalous behavior, or a change type factor that considers a type of change event; and identify a subset of said network components that are suspected to be root causes based on said likelihood score.