Activity Tracing Through Event Correlation Across Multiple Software Applications

A non-transitory computer-readable medium, having stored thereon program instructions that, upon execution by a computing system, cause the computing system to perform operations comprising:

• identifying local traces of related events associated with a plurality of software applications;
• determining positive rules that define when pairs of the local traces are linked to a common global trace, and negative rules that define when the pairs of the local traces are linked to different global traces;
• based on the positive rules and the negative rules, linking the pairs of the local traces into global traces;
• and
• using the pairs of the local traces that are linked to the global traces as training data, iteratively training a similarity model such that the pairs of the local traces that are linked to common global traces exhibit a greater similarity with one another than the pairs of the local traces that are linked to different global traces.

A computing system comprising:

• one or more processors;
• memory;
• and
• program instructions, stored in the memory, that upon execution by the one or more processors cause the computing system to perform operations comprising:
• identifying local traces of related events associated with a plurality of software applications;
• determining positive rules that define when pairs of the local traces are linked to a common global trace, and negative rules that define when the pairs of the local traces are linked to different global traces;
• based on the positive rules and the negative rules, linking the pairs of the local traces into global traces;
• and
• using the pairs of the local traces that are linked to the global traces as training data, iteratively training a similarity model such that the pairs of the local traces that are linked to common global traces exhibit a greater similarity with one another than the pairs of the local traces that are linked to different global traces.