Identifying heartbeat messages

A non-transitory machine-readable storage medium encoded with instructions executable by a hardware processor of a computing device for identifying heartbeat messages, the machine-readable storage medium comprising instructions to cause the hardware processor to:

• obtain a plurality of messages transmitted between a first device and a second device;
• identify, from the plurality of messages, candidate message pairs, each candidate message pair including i) an incoming message sent to the first device from the second device, and ii) an outgoing message that was sent to the second device from the first device in response to receipt of the incoming message;
• and
• identify, from the identified candidate message pairs, a heartbeat message pair, the heartbeat message pair including an incoming message and a corresponding outgoing message, the corresponding outgoing message being outputted by the first device in response to receipt of the incoming message from the second device by the first device, based on a number of occurrences of matching candidate message pairs included in a message log.

A method for identifying heartbeat messages, implemented by a hardware processor, the method comprising:

• obtaining a plurality of messages that includes incoming messages and outgoing messages, each incoming message being sent from a first device to a second device, and each outgoing message being sent from the second device to the first device;
• identifying, from the plurality of messages, candidate message pairs, each candidate message pair including one incoming message and one outgoing message;
• identifying, from the candidate message pairs, a heartbeat message pair, the heartbeat message pair including an incoming message and a corresponding outgoing message, the corresponding outgoing message being outputted by the second device in response to receipt of the incoming message from the first device by the second device, based on i) incoming message timestamps that each correspond to one of the incoming messages, and ii) outgoing message timestamps that each correspond to one of the outgoing messages;
• determining, for a particular candidate message pair, that a difference in time between the incoming message and the outgoing message of the particular candidate message pair is within a threshold period of time, the difference in time being determined based on i) an incoming message timestamp for the incoming message of the particular candidate message pair, and ii) an outgoing message timestamp for the outgoing message of the particular candidate message pair;
• and
• identifying the particular candidate message pair as the heartbeat message pair in response to determining that the difference in time is within the threshold period of time.