Systems and methods for detecting system configuration changes

A system comprising:

• memory to store machine-readable instructions;
• one or more processors to access the memory and execute the machine-readable instructions, the machine-readable instructions implementing a network analyzer comprising:
• a network aggregator configured to:
• aggregate network traffic to provide aggregated network traffic, and extract metadata from the aggregated network traffic, the metadata being for a system configuration change of the system;
• evaluate the metadata relative to a configuration change database to determine whether the system configuration change is an authorized system configuration change based on the metadata;
• provide the metadata to a metadata evaluator in response to determining that the system configuration change is not an authorized system configuration change based on the configuration change database;
• and
• a metadata evaluator configured to:
• determine, using a trained machine learning (ML) model, whether the system configuration change is an authorized system configuration change in response to receiving the metadata and based on change management data from a change management system, the ML model being trained based on a metadata table and system change data, the metadata table comprising metadata categories for previously received metadata extracted from the network traffic, the metadata categories including authorized and unauthorized metadata categories that are assigned to respective metadata extracted from the network traffic, the system change data identifying authorized and unauthorized system configuration changes for the system;
• and
• cause the configuration change database to be updated with the system configuration change in response to determining that the system configuration change is an authorized system configuration change so that similar future system configuration changes for the system or a different system are authorized by the network aggregator using the configuration change database.