1. A computer program product for determining suspected root causes of anomalous network behavior, cornprising: a non-transitory computer readable storage medium, said non-transitory computer readable storage medium comprising computer readable program code embodied therewith, said computer readable program code comprising program instructions that, when executed, causes a processor to: identify anomalous components in a network exhibiting anomalous behavior from a plurality of network components; assign a likelihood score to said network components based on a scoring policy that considers recent change events affecting said anomalous components; and identify a subset of said network components that are suspected to be root causes based on said likelihood score.