US 2011/0258209 A1 · RULE ORGANIZATION FOR EFFICIENT TRANSACTION PATTERN MATCHING

Abstract

Efficiently identifying transactions processed by a software application, such as a server application is disclosed. In one embodiment, transactions are identified by applying a set of rules to communications between a client and server to determine whether certain patterns are in the communications. For example, the rules may look for some combination of parameters in the transactions. As a particular example, the rules may be used to look for parameters in HTTP requests. The rules are organized in a way that allows efficient processing. For example, the rules may be organized based on the frequency with which the parameters are expected to occur in the transactions and the frequency with which each transaction is expected to occur. The rules may be updated if the expected frequencies deviate from actual frequencies, such that the rules can be organized for more efficient processing.

Claims26

Dependent claims

A method of updating rules for identifying transactions, the method comprising:

monitoring communications between clients and an application that processes transactions;
applying rules to identify which transactions are processed by the application, the rules have an organization, applying the rules is based on the organization;
analyzing the communications;
and
updating the organization of the rules based on the analyzing the communications.

2 more elements

A monitoring system, comprising:

one or more storage devices having processor executable code stored thereon;
and
one or more processors in communication with the one or more storage devices, the code, which when executed on the one or more processors, causes the one or more processors to monitor transactions processed by applications, the transactions include patterns, the code causes the one or more processors to apply rules to identify which transactions are processed by the applications, the rules are organized based on frequencies with which the patterns are expected to appear in the transactions and based on frequencies with which each of the transactions is expected to be processed by the applications, the code causes the one or more processors apply the rules based on the organization of the rules, the code causes the one or more processors to determine when actual frequency of the patterns in the transactions deviates from the expected frequency of the patterns or when actual frequency of ones of the transactions deviates from the expected frequency of ones of the transactions, the code causes the one or more processors to update the organization of the rules based on the actual frequency of the parameters or the actual frequency of the transactions.

A method of updating a data structure for identifying transactions, the method comprising:

providing a first version of the data structure to a plurality of agents that monitor applications that process transactions, the transactions have one or more parameters of a plurality of parameters, the data structure is organized based on the plurality of parameters and includes rules for identifying the transactions based on the plurality of parameters;
identifying which transactions are processed by the applications based on the organization of the data structure;
collecting frequency data, by the agents, that describes frequency with which each of the transactions are identified and frequency with which each of the parameters appear in the transactions;
providing the frequency data to a manager node;
updating the organization of the data structure based on the frequency data;
and
providing the updated data structure to the plurality of agents.

4 more elements

Dependencies are inferred from the claim text.

Rule organization for efficient transaction pattern matching

Life of this patent

Rule organization for efficient transaction pattern matching

Life of this patent

Abstract

Claims26