Monitoring computer process resource usage

• US 10,003,547 B2
• Filed: 08/03/2015
• Issued: 06/19/2018
• Est. Priority Date: 05/07/2010
• Status: Active Grant

• Current Assignee: Fidelis LLC
• Original Assignee: Ziften Technologies Incorporated
• Inventors: Obrecht, Mark E., Myers, Robert P., Hartmann, Alfred C., Alagna, Nick F., Pyle, Kevin N., Sullivan, Scott D., Little, Michael W.
• Primary Examiner(s): Tang, Kenneth
• Application Number:
  US14/817,050
• Publication Number:
  US 20160036722A1
• Time in Patent Office: 1,051 Days
• Field of Search: None
• CPC Class Codes: G06F 11/3003 Monitoring arrangements specially adapted to the computing system or computing system component being monitored
• CPC Class Codes: G06F 11/3051 Monitoring arrangements for monitoring the configuration of the computing system or of the computing system component, e.g. monitoring the presence of processing resources, peripherals, I/O links, software programs verification or detection of system hardware configuration G06F11/2247
• CPC Class Codes: G06F 11/3409 for performance assessment
• CPC Class Codes: G06F 11/3442 for planning or managing the needed capacity
• CPC Class Codes: G06F 11/3452 Performance evaluation by statistical analysis
• CPC Class Codes: G06F 11/3466 Performance evaluation by tracing or monitoring
• CPC Class Codes: G06F 21/554 involving event detection and direct action
• CPC Class Codes: G06F 21/566 Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities
• CPC Class Codes: G06F 2201/865 Monitoring of software
• CPC Class Codes: G06F 2221/034 Test or assess a computer or a system
• CPC Class Codes: G06F 2221/2135 Metering
• CPC Class Codes: G06F 9/50 Allocation of resources, e.g. of the central processing unit [CPU]
• CPC Class Codes: H04L 43/0876 Network utilisation, e.g. volume of load or congestion level
• CPC Class Codes: H04L 47/783 Distributed allocation of resources, e.g. bandwidth brokers
• CPC Class Codes: Y02D 10/00 Energy efficient computing, e.g. low power processors, power management or thermal management

Abstract

Techniques are disclosed relating to improving resource usage on a computer system. In one embodiment, a computer system identifies a plurality of processes running on the computer system and determines an importance value and a resource consumption value. In such an embodiment, the importance value is indicative of an importance of an identified process, and the resource consumption value is indicative of a resource consumption of the identified process. The computer system evaluates the importance value and the resource consumption value relative to a usage policy, and takes a corrective action with respect to the identified process based on the evaluating to reconcile resource consumption with process importance value.

Claims

1. A method, comprising:

a first computer system establishing a secure network session with a second computer system;

the first computer system analyzing processes executing on the first computer system during the secure network session based on a set of criteria;

based on the analyzing, the first computer system identifying a first set of the processes that correspond to the secure network session and a second set of the processes that do not correspond to the secure network session;

responsive to the identifying, the first computer system prioritizing the first set of processes relative to the second set of processes, wherein the prioritizing includes;

the first computer system allocating additional computing resources to one or more of the first set of the processes, wherein the first set of the processes includes a process that communicates via the secure network session; and

the first computer system suspending one or more of the second set of the processes.

2. The method of claim 1, wherein the first computer system identifies a first process as corresponding to the secure network session based on whether the first process is associated with a particular digital signature.

3. The method of claim 1, wherein the first computer system identifies a first process as corresponding to the secure network session based on the first process'"'"'s network traffic.

4. The method of claim 1, wherein the first computer system identifies a first process as corresponding to the secure network session in response to determining that the first process is associated with an open window.

5. The method of claim 1, wherein the first computer system identifies a first process as corresponding to the secure network session in response to determining that the first process was used to establish the secure network session.

6. The method of claim 1, wherein the first computer system identifies a first process as corresponding to the secure network session in response to determining the first process is a process of a web browser application.

7. The method of claim 1, wherein the secure network session is a secure-socket-layer (SSL) session or a virtual private network (VPN) session.

8. The method of claim 1, wherein the allocating includes allocating additional processor usage or additional memory space to one or more of the first set of the processes.

9. The method of claim 1, wherein the allocating is performed only for the duration of the secure network session.

10. The method of claim 1, wherein the first set of the processes includes a process executed by the first computer system to establish the secure network session.

11. A non-transitory, computer-readable medium having program instructions stored thereon that are executable to cause a first computer system to perform operations comprising:

establishing a network session with a second computer system to communicate data;

identifying processes executing on the first computer system as session processes and non-session processes based on one or more criteria, wherein the session processes are relevant to the established network session, and wherein the non-session processes are not relevant to the established network session, wherein the one or more criteria include whether a process produces network traffic for the network session; and

in response to the identifying, prioritizing the sessions processes by allocating additional computing resources to one or more of the session processes, wherein the one or more session processes includes a process that produces network traffic for the network session.

12. The computer-readable medium of claim 11, wherein the operations further comprise:

in response to being unable to determine whether a first process is relevant to the network session, identifying the first process as a non-session process.

13. The computer-readable medium of claim 11, wherein the operations further comprise:

performing at least one of suspending or terminating for ones of the non-session processes.