# US 11,442,836 B2 · Method and system for real-time correlation of disparate sources of topological information to create a unified topological model of a distributed information system

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 11,442,836 B2
- Document ID: US11442836B2
- Status: Granted
- Kind: B2
- Application number: 16/276,710
- Filed: 2019-02-15
- Published: 2019-08-29
- Granted: 2022-09-13
- Earliest claimed: 2018-02-23
- Assignees: Dynatrace LLC
- Applicants: Dynatrace LLC
- Inventors: Herwig Moser; Michael Kopp; Ernst Ambichl
- Web page: https://patentgrep.com/patent/US11442836B2

## CPC

- G06F 11/3447: {Performance evaluation by modeling}
- G06F 11/0709: {in a distributed system consisting of a plurality of standalone computer nodes, e.g. clusters, client-server systems}
- G06F 11/079: {Root cause analysis, i.e. error or fault diagnosis (in a hardware test environment G06F11/22; in a software test environment G06F11/36)}
- G06F 11/3006: {where the computing system is distributed, e.g. networked systems, clusters, multiprocessor systems (multiprogramming arrangements G06F9/46; allocation of resources G06F9/50)}
- G06F 11/3048: {where the topology of the computing system or computing system component explicitly influences the monitoring activity, e.g. serial, hierarchical systems}
- G06F 11/3051: {Monitoring arrangements for monitoring the configuration of the computing system or of the computing system component, e.g. monitoring the presence of processing resources, peripherals, I/O links, software programs (verification or detection of system hardware configuration G06F11/2247)}
- G06F 11/3089: {Monitoring arrangements determined by the means or processing involved in sensing the monitored data, e.g. interfaces, connectors, sensors, probes, agents (software debugging using additional hardware using a specific debug interface G06F11/3656; performance evaluation by tracing or monitoring G06F11/3466)}
- G06F 11/3409: {for performance assessment}
- G06F 11/3461: {Trace driven simulation}
- G06F 11/3466: {Performance evaluation by tracing or monitoring}
- G06F 11/3495: {for systems}
- G06N 5/022: Knowledge engineering; Knowledge acquisition
- G06N 5/04: Inference or reasoning models
- G06F 2201/87: Monitoring of transactions
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)
- G06N: COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS

## Abstract

A system and method is disclosed for the combined analysis of transaction execution monitoring data and a topology model created from infrastructure monitoring data of computing systems involved in the execution of the monitored transactions. Monitored communication activities of transactions are analyzed to identify intermediate processing nodes between sender and receiver side and to enrich transaction monitoring data with data describing those intermediate processing nodes. The topology model may also be improved by the combined analysis, as functionality and services provided by elements of the topology model may be derived by the involvement of those elements in the execution of monitored transactions. The result of the combined analysis is used by an automated anomaly detection and causality estimation system. The combined analysis may also reveal entities of a monitored environment that are used by transaction executions but which are not monitored.

## Claims

### Claim 1

A computer-implemented method for monitoring transactions executing in a distributed computing environment, comprising:
receiving, by a topology processor, topology data from one or more agents, wherein the topology data describes computing resources comprising the distributed computing environment and the one or more agents are instrumented in the computing resources;
constructing, by the topology processor, a topology model using the topology data, wherein the topology model includes topology entities which collectively describe a network topology of the computing resources;
receiving, by an inference processor, transaction trace data captured by a given agent of the one or more agents, wherein the transaction trace data identifies a given transaction being executed between a sender application and a receiver application and includes a performance metric for the given transaction;
identifying, by the inference processor, a particular computing resource of the computing resources which executes at least a portion of the given transaction;
determining, by the inference processor, a presence of a given topology entity in the topology model, wherein the given topology entity in the topology model corresponds to the particular computing resource of the computing resources, and wherein determining the presence of the given topology entity in the topology model includes extracting a network address for the particular computing resource of the computing resources from the transaction trace data and querying the topology model for topology entities having a network address that matches the extracted network address for the particular computing resource of the computing resources;
updating, by the inference processor, the topology model with information for the given topology entity in the topology model, wherein the updating of the topology model occurs in response to a determination that the given topology entity in the topology model is absent from the topology model; and
updating, by the inference processor, the transaction trace data with identification data for the given topology entity in the topology model.

### Claim 2 (depends on 1)

The computer-implemented method of claim 1 wherein the particular computing resource of the computing resources is one of a host computing device, an operating system on a host computing device, and a process run by an operating system of a host computing device.

### Claim 3 (depends on 1)

The computer-implemented method of claim 1 further comprising:
extracting, by the inference processor, the receiver application from the transaction trace data, wherein the sender application resides on a host sender computer and the receiver application resides on a host receiver computer;
determining, by the inference processor, a presence of a given topology entity in the topology model, wherein the given topology entity in the topology model supports the receiver application residing on the host receiver computer; and
updating, by the inference processor, the topology model with information for the given topology entity in the topology model, wherein the updating of the topology model occurs in response to a determination that the given topology entity in the topology model is absent from the topology model.

### Claim 4 (depends on 1)

The computer-implemented method of claim 1 further comprising:
identifying, by the inference processor, at least one intermediate node from the transaction trace data, wherein the at least one intermediate node from the transaction trace data is disposed in a network between the sender application and the receiver application and the given transaction is executed in part by the at least one intermediate node from the transaction trace data;
determining, by the inference processor, a presence of a given topology entity in the topology model, wherein the given topology entity in the topology model corresponds to the at least one intermediate node from the transaction trace data; and
updating, by the inference processor, the topology model with information for the given topology entity in the topology model, wherein the updating of the topology model occurs in response to a determination that the given topology entity in the topology model is absent from the topology model.

### Claim 5 (depends on 1)

The computer-implemented method of claim 1 further comprising:
determining whether the given topology entity in the topology model can be monitored with an agent of the one or more agents using a network address for the given topology entity in the topology model, wherein the determining of whether the given topology entity in the topology model can be monitored is in response to a determination that the given topology entity in the topology model is absent from the topology model; and
notifying a system administrator about the given topology entity in the topology model in response to the determination that the given topology entity in the topology model can be monitored with the agent of the one or more agents using the network address for the given topology entity in the topology model.

### Claim 6 (depends on 1)

The computer-implemented method of claim 1 further comprising identifying, by an anomaly detector, abnormal execution of the given transaction and analyzing the abnormal execution of the given transaction in view of the updated topology model and in view of the updated transaction trace data.

### Claim 7

A computer-implemented method for monitoring transactions executing in a distributed computing environment, comprising:
receiving, by a topology processor, topology data from one or more agents, wherein the topology data describes computing resources comprising the distributed computing environment and the one or more agents are instrumented in the computing resources;
constructing, by the topology processor, a topology model using the topology data, wherein the topology model includes topology entities which collectively describe a network topology of the computing resources;
receiving, by an inference processor, transaction trace data captured by a given agent of the one or more agents, wherein the transaction trace data identifies a given transaction being executed between a sender application and a receiver application and includes a performance metric for the given transaction;
identifying, by the inference processor, at least one intermediate node from the transaction trace data, wherein the at least one intermediate node from the transaction trace data is disposed in a network between the sender application and the receiver application and the given transaction is executed in part by the at least one intermediate node from the transaction trace data;
determining, by the inference processor, a presence of a given topology entity in the topology model, wherein the given topology entity in the topology model corresponds to the at least one intermediate node from the transaction trace data, and wherein determining the presence of the given topology entity in the topology model includes extracting a network address for the particular computing resource of the computing resources from the transaction trace data and querying the topology model for topology entities having a network address that matches the extracted network address for the particular computing resource of the computing resources;
updating, by the inference processor, the topology model with information for the given topology entity in the topology model, wherein the updating of the topology model occurs in response to a determination that the given topology entity in the topology model is absent from the topology model; and
updating, by the inference processor, the transaction trace data with identification data for the given topology entity in the topology model.

### Claim 8 (depends on 7)

The computer-implemented method of claim 7 further comprising determining, by the inference processor, a process that handled the given transaction on the at least one intermediate node from the transaction trace data, wherein the determining of the process that handled the given transaction occurs in response to a determination that the given topology entity in the topology model is present in the topology model.

### Claim 9 (depends on 7)

The computer-implemented method of claim 7 further comprising receiving a portion of the topology data from an operating system (OS) agent instrumented in an operating system of a computing device, wherein the topology data identifies the operating system, identifies the computing device, and identifies processes handled by the operating system.

### Claim 10 (depends on 9)

The computer-implemented method of claim 9 further comprising monitoring containers and capturing container port mapping data, wherein the topology data includes the container port mapping data and the container port mapping data specifies a relationship between a port and a process executing in a container.

### Claim 11 (depends on 7)

The computer-implemented method of claim 7 further comprising receiving a portion of the topology data from a cloud/virtualization agent, wherein the cloud/virtualization agent is interfaced with a cloud management system and the topology data identifies type and functionality of virtualized entities in the distributed computing environment.

### Claim 12 (depends on 7)

The computer-implemented method of claim 7 wherein the transaction trace data includes network addresses for the at least one intermediate node from the transaction trace data extracted from a message exchanged between the sender application and the receiver application.

### Claim 13 (depends on 7)

The computer-implemented method of claim 7 wherein the transaction trace data includes information extracted from an X-Forwarded-For (XFF) Hypertext Transfer Protocol (HTTP) header field.

### Claim 14 (depends on 7)

The computer-implemented method of claim 7 further comprising:
extracting, by the inference processor, the receiver application from the transaction trace data, wherein the sender application resides on a host sender computer and the receiver application resides on a host receiver computer;
determining, by the inference processor, a presence of a given topology entity in the topology model, wherein the given topology entity in the topology model supports the receiver application residing on the host receiver computer; and
updating, by the inference processor, the topology model with information for the given topology entity in the topology model, wherein the updating of the topology model occurs in response to a determination that the given topology entity in the topology model is absent from the topology model.

### Claim 15 (depends on 7)

The computer-implemented method of claim 7 wherein the updating of the topology model further comprises adding the given topology entity to the topology model.

### Claim 16 (depends on 7)

The computer-implemented method of claim 7 further comprising:
determining whether the given topology entity in the topology model can be monitored with an agent of the one or more agents using a network address for the given topology entity in the topology model, wherein the determining of whether the given topology entity in the topology model can be monitored is in response to a determination that the given topology entity in the topology model is absent from the topology model; and
notifying a system administrator about the given topology entity in the topology model in response to the determination that the given topology entity in the topology model can be monitored with the agent of the one or more agents using the network address for the given topology entity in the topology model.

### Claim 17 (depends on 7)

The computer-implemented method of claim 7 further comprising identifying, by an anomaly detector, abnormal execution of the given transaction and analyzing the abnormal execution of the given transaction in view of the updated topology model and in view of the updated transaction trace data.

### Claim 18

A computer-implemented method for monitoring transactions executing in a distributed computing environment, comprising:
receiving, by a topology processor, topology data from one or more agents, wherein the topology data describes computing resources comprising the distributed computing environment and the one or more agents are instrumented in the computing resources;
constructing, by the topology processor, a topology model using the topology data, wherein the topology model includes topology entities which collectively describe a network topology of the computing resources;
receiving, by an inference processor, transaction trace data captured by a given agent of the one or more agents, wherein the transaction trace data identifies a given transaction being executed between a sender application and a receiver application and includes a performance metric for the given transaction;
extracting, by the inference processor, the receiver application from the transaction trace data, wherein the sender application resides on a host sender computer and the receiver application resides on a host receiver computer;
determining, by the inference processor, a presence of a given topology entity in the topology model, wherein the given topology entity in the topology model supports the receiver application residing on the host receiver computer, and wherein determining the presence of the given topology entity in the topology model includes extracting a network address for the particular computing resource of the computing resources from the transaction trace data and querying the topology model for topology entities having a network address that matches the extracted network address for the particular computing resource of the computing resources;
updating, by the inference processor, the topology model with information for the given topology entity in the topology model, wherein the updating of the topology model occurs in response to a determination that the given topology entity in the topology model is absent from the topology model; and
updating, by the inference processor, the transaction trace data with identification data for the given topology entity in the topology model.

### Claim 19 (depends on 18)

The computer-implemented method of claim 18 further comprising receiving a portion of the topology data from an operating system (OS) agent instrumented in an operating system of a computing device, wherein the topology data identifies the operating system, identifies the computing device, and identifies processes handled by the operating system.

### Claim 20 (depends on 19)

The computer-implemented method of claim 19 further comprising monitoring containers and capturing container port mapping data, wherein the topology data includes the container port mapping data and the container port mapping data specifies a relationship between a port and a process executing in a container.

### Claim 21 (depends on 18)

The computer-implemented method of claim 18 further comprising receiving a portion of the topology data from a cloud/virtualization agent, wherein the cloud/virtualization agent is interfaced with a cloud management system and the topology data identifies type and functionality of virtualized entities in the distributed computing environment.

### Claim 22 (depends on 18)

The computer-implemented method of claim 18 wherein the transaction trace data includes a network address for the host receiver computer and determines the presence of the given topology entity in the topology model using the network address for the host receiver computer.

### Claim 23 (depends on 18)

The computer-implemented method of claim 18 wherein the transaction trace data includes a network address of a host sender computer and a port used by the sender application on the host sender computer, and further comprises determining whether a process corresponding to the sender application was executed in a container using the port used by the sender application on the host sender computer.

### Claim 24 (depends on 18)

The computer-implemented method of claim 18 wherein the transaction trace data includes a network address of the host receiver computer and a port used by the receiver application on the host receiver computer, and further comprises:
determining process data for the receiver application using the given topology entity in the topology model; and
determining whether a process corresponding to the receiver application was executed in a container using the port used by the receiver application on the host receiver computer.

### Claim 25 (depends on 18)

The computer-implemented method of claim 18 further comprising:
identifying, by the inference processor, at least one intermediate node from the transaction trace data, wherein the at least one intermediate node from the transaction trace data is disposed in a network between the sender application and the receiver application and the given transaction is executed in part by the at least one intermediate node from the transaction trace data;
determining, by the inference processor, a presence of a given topology entity in the topology model, wherein the given topology entity in the topology model corresponds to the at least one intermediate node from the transaction trace data; and
updating, by the inference processor, the topology model with information for the given topology entity in the topology model, wherein the updating of the topology model occurs in response to a determination that the given topology entity in the topology model is absent from the topology model.

### Claim 26 (depends on 18)

The computer-implemented method of claim 18 further comprising:
determining whether the given topology entity in the topology model can be monitored with an agent of the one or more agents using a network address for the given topology entity in the topology model, wherein the determining of whether the given topology entity in the topology model can be monitored is in response to a determination that the given topology entity in the topology model is absent from the topology model; and
notifying a system administrator about the given topology entity in the topology model in response to the determination that the given topology entity in the topology model can be monitored with the agent of the one or more agents using the network address for the given topology entity in the topology model.

### Claim 27 (depends on 26)

The computer-implemented method of claim 26 further comprising:
identifying another topology entity in the topology model, wherein the other topology entity in the topology model has a network address the same as the given topology entity in the topology model and an entity type indicating a virtualized host system; and
notifying a system administrator to place an operating system (OS) agent at the virtualized host system.

### Claim 28 (depends on 18)

The computer-implemented method of claim 18 further comprising identifying, by an anomaly detector, abnormal execution of the given transaction and analyzing the abnormal execution of the given transaction in view of the updated topology model and in view of the updated transaction trace data.