Managed entity configurator anomaly detection

Abstract

Detecting an anomalous configurator of a plurality of managed entities. A plurality of configuration trees, each representing configuration parameters at a corresponding managed entity, include annotations that identify a configurator that configured each parameter. For a particular configurator, a plurality of subtrees is generated from the plurality of configuration trees. A set of weighted edit distances are calculated from the plurality of subtrees, each representing a degree of difference between a different pair of subtrees. A distance matrix is populated with the set of weighted edit distances, and the distance matrix is used to identify anomalous subtree(s) within the plurality of subtrees for the particular configurator. In embodiments, a configuration corresponding to an anomalous subtree considered to have been anomalously applied by the particular configurator. Data that identifies at least one managed entity associated with the anomalous subtree, and the particular configurator is stored.