Root cause detection of anomalous behavior using network relationships and event correlation

A system, comprising:

• one or more processors;
• and
• one or more non-transitory computer-readable media storing computer-executable instructions that, when executed, cause the one or more processors to perform operations comprising:
• detecting an alert indicating a first anomalous event in a networked computing environment, the first anomalous event affecting a first node in the networked computing environment;
• correlating the first node with a previously detected alert wherein:
• the previously detected alert indicates a second anomalous event comprising a request to perform an action at the first node;
• and
• the alert and the previously detected alert comprise a set of correlated alerts;
• recursively identifying a root cause of the first anomalous event based at least in part on the set of correlated alerts, the root cause identifying a second node in the networked computing environment;
• generating a directed acyclic graph comprising a first vertex representing the first node, a second vertex representing the second node, and a directed edge connecting the first vertex and the second vertex, and indicating that the root cause caused the second node to affect the first node, wherein the directed edge comprises a probability that the root cause caused the second node to affect the first node;
• and
• resolving the root cause of the first anomalous event at the second node.

A non-transitory computer-readable medium comprising instructions that, when executed by one or more processors, cause the one or more processors to perform operations comprising:

• detecting an alert indicating a first anomalous event in a networked computing environment, the first anomalous event affecting a first node in the networked computing environment;
• correlating the first node with a previously detected alert wherein:
• the previously detected alert indicates a second anomalous event comprising a request to perform an action at the first node;
• and
• the alert and the previously detected alert comprise a set of correlated alerts;
• recursively identifying a root cause of the first anomalous event based at least in part on the set of correlated alerts, the root cause identifying a second node in the networked computing environment;
• generating a directed acyclic graph comprising a first vertex representing the first node, a second vertex representing the second node, and a directed edge connecting the first vertex and the second vertex, and indicating that the root cause caused the second node to affect the first node, wherein the directed edge comprises a probability that the root cause caused the second node to affect the first node;
• and
• resolving the root cause of the first anomalous event at the second node.

A system for determining a root cause of anomalous events in a networked computing environment, the system comprising:

• means for detecting an alert indicating a first anomalous event in the networked computing environment, the first anomalous event affecting a first node in the networked computing environment;
• means for correlating the first node with a previously detected alert wherein:
• the previously detected alert indicates a second anomalous event comprising a request to perform an action at the first node;
• and
• the alert and the previously detected alert comprise a set of correlated alerts;
• means for recursively identifying a root cause of the first anomalous event based at least in part on the set of correlated alerts, the root cause identifying a second node in the networked computing environment;
• means for generating a directed acyclic graph comprising a first vertex representing the first node, a second vertex representing the second node, and a directed edge connecting the first vertex and the second vertex, and indicating that the root cause caused the second node to affect the first node, wherein the directed edge comprises a probability that the root cause caused the second node to affect the first node;
• and
• means for resolving the root cause of the first anomalous event at the second node.