US 7,689,610 B2 · Automated grouping of messages provided to an application using string similarity analysis

Abstract

Messages which are provided to an application are monitored. Similarities between the messages are determined based on a distance algorithm, in one approach, and messages which are similar are assigned to a common group. For example, the messages may be HTTP messages which include a URL, HTTP header parameters and/or HTTP post parameters. The messages are parsed to derive a string which is used in the distance calculations. Additionally, application runtime data such as response times is obtained and aggregated for the group. Further, a representative message can be determined for each group for comparison to subsequent messages. Results can be reported which include a group identifier, representative message, count and aggregated runtime data.

Claims28

Dependent claims

A computer-implemented method for classifying messages, comprising:

monitoring a plurality of messages which are sent to an application, each message includes a request for the application to perform a transaction, and the application executes in response to the request of each message;
obtaining a string from each message;
for each message, obtaining runtime data regarding execution of the application, and associating the runtime data with the string of the message;
calculating a distance between the string of each message and the strings of each other message of the plurality of messages by comparing the string of each message and the strings of each other message of the plurality of messages using a message distance algorithm;
grouping the strings according to the distances into a plurality of groups, each group has a message group identifier, and each string is associated with one of the message group identifiers;
and
for each message group identifier, aggregating the runtime data which is associated with the strings which are associated with the message group identifier, so that aggregated runtime data is provided for each group of the plurality of groups.

4 more elements

A computer-implemented method for classifying messages, comprising:

monitoring a plurality of messages which are sent to an application;
obtaining a string from each message;
calculating a distance between the string of each message and the strings of each other message of the plurality of messages by comparing the string of each message and the strings of each other message of the plurality of messages using a message distance algorithm;
grouping the strings according to the distances into a plurality of groups, each group has a message group identifier, and each string is associated with one of the message group identifiers;
for each message group identifier, selecting one of the strings which is associated with the message group identifier as a representative string;
obtaining a string from a new message sent to the application, the message comprises a request for the application to perform a transaction;
calculating a distance between the string of the new message and the representative string of each group of the plurality of groups;
and
grouping the string of the new message into one of the different groups for which the distance is a minimum.

6 more elements

At least one processor readable storage device having processor readable code embodied thereon for programming at least one processor to perform a method, the method comprising:

monitoring a plurality of messages which are sent to an application, each message includes a request for the application to perform a transaction, and the application executes in response to the request of each message;
obtaining a string from each message;
for each message, obtaining runtime data regarding execution of the application, and associating the runtime data with the string of the message;
calculating a distance between the string of each message and the strings of each other message of the plurality of messages by comparing the string of each message and the strings of each other message of the plurality of messages using a message distance algorithm;
grouping the strings according to the distances into a plurality of groups, each group has a message group identifier, and each string is associated with one of the message group identifiers;
and
for each message group identifier, aggregating the runtime data which is associated with the strings which are associated with the message group identifier, so that aggregated runtime data is provided for each group of the plurality of groups.