Identifying software responsible for changes in system stability

A computer-implemented method, comprising:

• detecting a stability change in a computer system;
• identifying a first set of at least one capability of the computer system that is affected by the stability change;
• identifying, in response to detecting the stability change, a software application that was installed or updated to the computer system prior to the stability change;
• identifying a second set of at least one capability of the computer system that is utilized by the identified software application;
• comparing the first set of at least one capability to the second set of at least one capability to determine a degree of similarity;
• comparing a first time that the stability change was detected to a second time that the identified software application was installed or updated to determine a temporal proximity;
• and
• identifying the likelihood that the identified software application is the cause of the stability change, wherein the identified likelihood is a function of the degree of similarity and the temporal proximity.