System and method of tracking messaging flows in a distributed network

• US 20040122937A1
• Filed: 12/18/2002
• Published: 06/24/2004
• Est. Priority Date: 12/18/2002
• Status: Abandoned Application

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Huang, Jack C., Pascual, Revelino M.
• Application Number:
  US10/322,919
• Publication Number:
  US 20040122937A1
• Time in Patent Office: Days
• US Class Current: 709/224
• CPC Class Codes: H04L 41/048 mobile agents
• CPC Class Codes: H04L 43/00 Arrangements for monitoring or testing data switching networks
• CPC Class Codes: H04L 43/06 Generation of reports
• CPC Class Codes: H04L 67/10 in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46
• CPC Class Codes: H04L 67/34 involving the movement of software or configuration parameters network booting or remote initial program loading [RIPL] G06F9/4416
• CPC Class Codes: H04L 69/329 in the application layer [OSI layer 7]
• CPC Class Codes: H04L 9/40 Network security protocols

Abstract

A system and method for tracking message flows throughout a distributed network using mobile surveillance agents (MSAs). The system comprises a repository of mobile surveillance agents (MSAs), wherein each MSA includes program code for monitoring a client program at a remote node in the distributed network and generating a surveillance report; a deployment system for deploying the MSAs to remote nodes; and a local intelligence contact (LIC) preloaded at each node for receiving a deployed MSA at the node.

Claims

1. A system for implementing message flow monitoring in a distributed network, comprising:

a repository of mobile surveillance agents (MSAs), wherein each MSA includes program code for monitoring a client program at a remote node in the distributed network and generating a surveillance report;

a deployment system for deploying the MSAs to remote nodes; and

a local intelligence contact (LIC) preloaded at each remote node for receiving a deployed MSA at the remote node.

2. The system of claim 1, wherein each MSA includes a set of logging parameters that controls the monitoring operation.

3. The system of claim 1, wherein the deployment system generates a deployment package that includes a set of LIC plugins, a set of MSA components, configuration information for the MSA, and installation code for the MSA.

4. The system of claim 1, wherein the deployment system includes a deployment agent that specifies a protocol for transporting an MSA to a node.

5. The system of claim 1, wherein the LIC preloaded at each remote node further includes a mechanism for distributing messages from the client program to the MSA.

6. The system of claim 5, wherein the LIC operates in a proxy mode that is decoupled from the client program.

7. The system of claim 5, wherein the LIC operates in a covert mode that is integrated into the client program.

8. The system of claim 1, further comprising an intelligence coordination agent (ICA) installed at a node in the network, wherein the ICA monitors surveillance reports generated by at least one MSA.

9. The system of claim 8, wherein the ICA can cause an MSA to be deployed.

10. The system of claim 8, wherein the ICA includes a system for searching for patterns in a surveillance report.

11. The system of claim 1, further comprising a grouping system for grouping a set of client programs with one MSA.

12. A method for monitoring message flows in a distributed network, comprising:

creating a mobile surveillance agent (MSA);

storing the MSA in a repository;

loading a local intelligence contact (LIC) at a remote node in the distributed network;

deploying the MSA to the remote node using the LIC to coordinate the deployment;

monitoring a client program at the remote node with the MSA; and

generating a surveillance report from the MSA.

13. The method of claim 12, wherein the monitoring step includes:

using the LIC to collect messages from the client program; and

passing the messages to the MSA.

14. The method of claim 12, including the further step of:

forwarding the surveillance report to a log target elsewhere within the distributed network.

15. The method of claim 12, including the further steps of:

deploying an intelligence coordination agent (ICA) at a second node in the distributed network, wherein the ICA includes an analysis system; and

forwarding the surveillance report from the MSA to the ICA for analysis.

16. The method of claim 15, including the further step of:

altering a behavior of the MSA based on the analysis.

17. A program product stored on a recordable medium, which when executed, implements message monitoring over a distributed network, wherein the program product comprises:

means for storing a plurality of mobile surveillance agents (MSAs), wherein each MSA includes program code for monitoring a client program at a remote node in the distributed network and generating a surveillance report;

means for deploying the MSAs to remote nodes; and

means for coordinating installation of a deployed MSA at the remote nodes.

18. The program product of claim 17, further comprising grouping means for grouping a set of client programs with one MSA.

19. An architecture for monitoring messages across a distributed network, comprising:

(a) a server, wherein the server includes;

a system for creating mobile surveillance agents (MSAs);

a repository for storing the MSAs; and

a deployment system for deploying MSAs throughout the distributed network;

(b) a plurality of remote nodes within the distributed network, wherein each remote node includes;

a client program executing on the remote node; and

a local intelligence agent (LIC) for coordinating an installation of an MSA deployed to the remote node, and for distributing messages from the client program to the MSA installed at the remote node; and

(c) at least one log target for receiving surveillance reports from MSAs deployed throughout the distributed network.

20. The architecture of claim 19, wherein each MSA includes a set of logging parameters that controls a monitoring operation of the messages received from the client program.

21. The architecture of claim 19, wherein the deployment system generates a deployment package that includes a set of LIC plugins, a set of MSA components, configuration information for the MSA, and installation code for the MSA.

22. The architecture of claim 19, wherein the deployment system includes a deployment agent that specifies a protocol for transporting an MSA to a remote node.

23. The architecture of claim 19, wherein the LIC operates in a proxy mode that is decoupled from the client program.

24. The architecture of claim 19, wherein the LIC operates in a covert mode that is integrated into the client program.

25. The architecture of claim 19, further comprising an intelligence coordination agent (ICA) installed at a remote node in the network, wherein the ICA monitors surveillance reports generated by at least one MSA.

26. The architecture of claim 25, wherein the ICA can cause an MSA to be deployed.

27. The architecture of claim 25, wherein the ICA includes a system for searching for patterns in a surveillance report.

28. The architecture of claim 19, further comprising a grouping system for grouping a set of client programs with one MSA.