# US 10,769,001 B2 · System and method for process state processing > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,769,001 B2 - Document ID: US10769001B2 - Status: Granted - Kind: B2 - Application number: 15/927,516 - Filed: 2018-03-21 - Published: 2019-09-26 - Granted: 2020-09-08 - Earliest claimed: 2018-03-21 - Assignees: DiDi Research America, LLC - Applicants: DiDi Research America, LLC - Inventors: Dong Li; Huaiyu Zhu; Jing Chen; Michael Lin; Shray Kapoor; Yichong Lin - Web page: https://patentgrep.com/patent/US10769001B2 ## CPC - G06F 9/542: {Event management; Broadcasting; Multicasting; Notifications} - G06F 11/3006: {where the computing system is distributed, e.g. networked systems, clusters, multiprocessor systems (multiprogramming arrangements G06F9/46; allocation of resources G06F9/50)} - G06F 9/544: {Buffers; Shared memory; Pipes} - G06F 9/545: {where tasks reside in different layers, e.g. user- and kernel-space} - G06F 9/546: {Message passing systems or structures, e.g. queues} - G06F 11/302: {where the computing system component is a software system} - G06F 11/3055: {Monitoring arrangements for monitoring the status of the computing system or of the computing system component, e.g. monitoring if the computing system is on, off, available, not available (error or fault processing without redundancy G06F11/0703; error detection or correction by redundancy in data representation G06F11/08; error detection or correction of the data by redundancy in operations G06F11/14; error detection or correction by redundancy in hardware G06F11/16)} - G06F 11/3089: {Monitoring arrangements determined by the means or processing involved in sensing the monitored data, e.g. interfaces, connectors, sensors, probes, agents (software debugging using additional hardware using a specific debug interface G06F11/3656; performance evaluation by tracing or monitoring G06F11/3466)} - G06F 12/0253: {Garbage collection, i.e. reclamation of unreferenced memory} - G06F 16/9024: {Graphs; Linked lists (G06F16/9027 takes precedence)} - G06F 16/951: Indexing; Web crawling techniques - G06F 9/54: Interprogram communication - G06F 11/3466: {Performance evaluation by tracing or monitoring} - G06F 2201/86: Event-based monitoring - G06F 2209/548: Queue - G06F 2212/1041: Resource optimization - G06F 2212/1048: Scalability - G06F 2212/163: Server or database system - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract Process states of computing devices may be obtained and processed. Process event information of a computing device may be obtained. The process event information may characterize states of processes of the computing device. The process event information may be stored within a queue. Graph information may be determined based on the process event information within the queue. The graph information may characterize states of processes of the computing device using nodes and edges. The graph information may be stored within a graph database. ## Claims ### Claim 1 A system for processing process states, the system comprising: one or more processors; and a memory storing instructions that, when executed by the one or more processors, cause the system to perform: obtaining process event information of a computing device, the process event information characterizing states of processes of the computing device; storing the process event information within a queue; determining graph information based on the process event information within the queue, the process event information including a respective unique process identifier for each of the processes of the computing device, each of the respective unique process identifiers being based on a combination of a respective reusable process identifier and a respective process start time, the graph information characterizing states of processes of the computing device using nodes and edges, each node of the graph information representing a respective process of the processes of the computing device, and each edge of the graph information representing a respective relationship between two or more processes of the processes of the computing device; determining, based on the respective edges of the graph information and the respective unique process identifiers based on the combination of the respective reusable process identifiers and the respective process start times, an order of any of the processes of the computing device or process events associated with the process event information; and storing the graph information within a graph database. ### Claim 2 (depends on 1) The system of claim 1, wherein the process event information is obtained from a process state collector agent running on the computing device. ### Claim 3 (depends on 2) The system of claim 2, wherein the process event information is obtained and stored within the queue by an event receiver server of the system. ### Claim 4 (depends on 3) The system of claim 3, wherein the queue is a distributed buffer storage. ### Claim 5 (depends on 3) The system of claim 3, wherein the graph information is determined by a stream processor of the system and the stream processor is, to determine the graph information, configured to identify and order process events based on the process event information within the queue. ### Claim 6 (depends on 5) The system of claim 5, wherein the graph information includes parent-child relationships and properties of the processes of the computing device. ### Claim 7 (depends on 5) The system of claim 5, wherein the stream processor uses process event information obtained at different times to identity missing process start events or missing process termination events. ### Claim 8 (depends on 1) The system of claim 1, wherein the graph information is stored within the graph database using a key-value database structure. ### Claim 9 (depends on 1) The system of claim 1, wherein the instructions further cause the system to perform: obtaining a query regarding a given process of the computing device; and determining a response to the query based on the graph information within the graph database. ### Claim 10 (depends on 9) The system of claim 9, wherein the query is obtained and responded to by a query server of the system. ### Claim 11 (depends on 10) The system of claim 10, wherein the query server provides a set of application programming interfaces to obtain and respond to the query, the set of application programming interfaces including a single-call application programming interface, an iterative application programming interface, and a batch-processing application programming interface. ### Claim 12 A method for processing process states, the method implemented by a computing system including one or more processors and non-transitory storage media storing machine-readable instructions, the method comprising: obtaining process event information of a computing device, the process event information characterizing states of processes of the computing device; storing the process event information within a queue; determining graph information based on the process event information within the queue, the process event information including a respective unique process identifier for each of the processes of the computing device, each of the respective unique process identifiers being based on a combination of a respective reusable process identifier and a respective process start time, the graph information characterizing states of processes of the computing device using nodes and edges, each node of the graph information representing a respective process of the processes of the computing device, and each edge of the graph information representing a respective relationship between two or more processes of the processes of the computing device; determining, based on the respective edges of the graph information and the respective unique process identifiers based on the combination of the respective reusable process identifiers and the respective process start times, an order of any of the processes of the computing device or process events associated with the process event information; and storing the graph information within a graph database. ### Claim 13 (depends on 12) The method of claim 12, wherein the process event information is obtained from a process state collector agent running on the computing device. ### Claim 14 (depends on 13) The method of claim 13, wherein the process event information is obtained and stored within the queue by an event receiver server of the computing system. ### Claim 15 (depends on 14) The method of claim 14, wherein the queue is a distributed buffer storage. ### Claim 16 (depends on 14) The method of claim 14, wherein the graph information is determined by a stream processor of the computing system and the stream processor is, to determine the graph information, configured to identify and order process events based on the process event information within the queue. ### Claim 17 (depends on 16) The method of claim 16, wherein the graph information includes parent-child relationships and properties of the processes of the computing device. ### Claim 18 (depends on 16) The method of claim 16, wherein the stream processor uses process event information obtained at different times to identity missing process start events or missing process termination events. ### Claim 19 (depends on 12) The method of claim 12, wherein the graph information is stored within the graph database using a key-value database structure. ### Claim 20 (depends on 12) The method of claim 12, further comprising: obtaining a query regarding a given process of the computing device; and determining a response to the query based on the graph information within the graph database. ### Claim 21 (depends on 20) The method of claim 20, wherein the query is obtained and responded to by a query server of the computing system. ### Claim 22 (depends on 21) The method of claim 21, wherein the query server provides a set of application programming interfaces to obtain and respond to the query, the set of application programming interfaces including a single-call application programming interface, an iterative application programming interface, and a batch-processing application programming interface.