Managed entity configurator anomaly detection

A computer system for detecting an anomalous configurator of a plurality of managed entities, comprising:

• a processor;
• and
• a computer storage media that stores computer-executable instructions that are executable by the processor to cause the computer system to at least:
• identify a plurality of configuration trees that each uses a hierarchical set of nodes to represent a set of configuration settings that has been applied to a corresponding managed entity in the plurality of managed entities, each configuration tree including one or more parameters that are annotated with information identifying a configurator that configured the parameter, the configurator being selected from among a plurality of configurators of the plurality of managed entities;
• based on a particular configurator of the plurality of configurators, generate a plurality of subtrees from the plurality of configuration trees, each subtree corresponding to a different configuration tree in the plurality of configuration trees and representing one or more configuration settings that were applied by the particular configurator;
• calculate a set of weighted edit distances from the plurality of subtrees, each weighted edit distance representing a degree of difference between a different pair of subtrees in the plurality of subtrees, each weighted edit distance being weighted based at least on a decreasing function of node depth within at least one subtree;
• populate a distance matrix with the set of weighted edit distances;
• using the distance matrix, identify one or more anomalous subtrees within the plurality of subtrees;
• based on identifying the one or more anomalous subtrees within the plurality of subtrees, store a data structure that identifies at least (a) at least one of the one or more managed entities associated with the one or more anomalous subtrees, and (b) the particular configurator;
• and
• initiate an automatic remediation action, including at least one of:
• disabling the particular configurator;
• decommissioning the particular configurator;
• migrating a service away from at least one managed entity associated with the one or more anomalous subtrees;
• rolling back a configuration of at least one managed entity associated with the one or more anomalous subtrees;
• resetting at least one managed entity associated with the one or more anomalous subtrees;
• or
• decommissioning at least one managed entity associated with the one or more anomalous subtrees.

A computer hardware storage device that stores computer-executable instructions that are executable by a processor to cause a computer system to at least:

• identify a plurality of configuration trees that each uses a hierarchical set of nodes to represent a set of configuration settings that has been applied to a corresponding managed entity in the plurality of managed entities, each configuration tree including one or more parameters that are annotated with information identifying a configurator that configured the parameter, the configurator being selected from among a plurality of configurators of the plurality of managed entities;
• based on a particular configurator of the plurality of configurators, generate a plurality of subtrees from the plurality of configuration trees, each subtree corresponding to a different configuration tree in the plurality of configuration trees and representing one or more configuration settings that were applied by the particular configurator;
• calculate a set of weighted edit distances from the plurality of subtrees, each weighted edit distance representing a degree of difference between a different pair of subtrees in the plurality of subtrees, each weighted edit distance being weighted based at least on a decreasing function of node depth within at least one subtree;
• populate a distance matrix with the set of weighted edit distances;
• using the distance matrix, identify one or more anomalous subtrees within the plurality of subtrees;
• based on identifying the one or more anomalous subtrees within the plurality of subtrees, store a data structure that identifies at least (a) at least one of the one or more managed entities associated with the one or more anomalous subtrees, and (b) the particular configurator;
• and
• initiate an automatic remediation action, including at least one of:
• disabling the particular configurator;
• decommissioning the particular configurator;
• migrating a service away from at least one managed entity associated with the one or more anomalous subtrees;
• rolling back a configuration of at least one managed entity associated with the one or more anomalous subtrees;
• resetting at least one managed entity associated with the one or more anomalous subtrees;
• or
• decommissioning at least one managed entity associated with the one or more anomalous subtrees.