Analysis of message sequences

• US 20050108384A1
• Filed: 10/23/2003
• Published: 05/19/2005
• Est. Priority Date: 10/23/2003
• Status: Abandoned Application

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Inventors: Cabrera, Luis Felipe, Lambert, John R.
• Application Number:
  US10/692,265
• Publication Number:
  US 20050108384A1
• Time in Patent Office: Days
• US Class Current: 709/224
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00

Abstract

A method and apparatus are described for investigating the behavior of an environment by analyzing messages passed between participants in the environment. The environment can pertain to a network, a machine, a system, a software program, or other environment. The analysis can use any kind of analysis to group sequences of messages into a collection of related sequences. The results of the analysis may reveal anomalous conditions within the environment, or other features of the environment.

Claims

1. A method for investigating messages passed in a message-passing environment, comprising:

collecting a plurality of messages from at least one participant in the message-passing environment;

assembling the messages into at least one message sequence;

analyzing said at least one message sequence to extract information regarding the message-passing environment; and

outputting the information.

2. The method according to claim 1, wherein the message-passing environment is a network environment including plural participants coupled together via a network.

3. The method according to claim 2, wherein the network uses an Internet Protocol to transmit messages between participants.

4. The method according to claim 2, wherein the messages express the information in one of a plurality of message formats.

5. The method according to claim 2, wherein the messages include information expressed in a markup language.

6. The method according to claim 5, wherein the markup language is the extensible markup language (XML).

7. The method according to claim 2, wherein the network uses Simple Object Access Protocol (SOAP) to transmit messages between participants.

8. The method according to claim 1, wherein the message-passing environment is a machine or system including plural interacting components that function as message participants.

9. The method according to claim 1, wherein the message-passing environment is a software program including plural interacting software modules that function as message participants.

10. The method according to claim 1, further comprising, after the collecting, converting identifying information pertaining to said at least one participant into an indication of a role played by the participant in the message-passing environment.

11. The method according to claim 1, wherein the assembling comprises combining multiple message traces into said at least one message sequence, each message trace pertaining to one or more messages transmitted by and/or received at a participant.

12. The method according to claim 1, wherein the assembling comprises assembling plural message sequences, and the analyzing comprises analyzing the plural message sequences.

13. The method according to claim 1, wherein the analyzing involves performing cluster analysis to group said at least one message sequence into at least one cluster.

14. The method according to claim 13, wherein the cluster analysis comprises:

forming a data matrix based on information in said at least one message sequence; and

forming said at least one cluster based on the data matrix.

15. The method according to claim 14, wherein the forming of the data matrix involves extracting features from said at least one message sequence.

16. The method according to claim 14, wherein the forming of the data matrix involves forming a similarity measure which measures the difference between said at least one message sequence and another message sequence.

17. The method according to claim 13, wherein the analyzing involves identifying results of the cluster analysis that may warrant further investigation.

18. The method according to claim 1, wherein the analyzing comprises comparing said at least one message sequence with a reference message sequence.

19. A computer readable medium including machine readable instructions for implementing the collecting, assembling, analyzing, and outputting recited in claim 1.

20. An apparatus for investigating messages passed in a message-passing environment, comprising:

message aggregation logic configured to collect a plurality of messages from at least one participant in the message-passing environment, and to assemble the messages into at least one message sequence;

analysis logic configured to analyze said at least one message sequence to extract information regarding the message-passing environment; and

output logic configured to output the information.

21. The apparatus according to claim 20, wherein the message-passing environment is a network environment including plural participants coupled together via a network.

22. The apparatus according to claim 21, wherein the network uses an Internet Protocol to transmit messages between participants.

23. The apparatus according to claim 21, wherein the messages express the information in one of a plurality of message formats.

24. The apparatus according to claim 21, wherein the messages include information expressed in a markup language.

26. The apparatus according to claim 21, wherein the network uses Simple Object Access Protocol (SOAP) to transmit messages between participants.

27. The apparatus according to claim 20, wherein the message-passing environment is a machine or system including plural interacting components that function as message participants.

28. The apparatus according to claim 20, wherein the message-passing environment is a software program including plural interacting software modules that function as message participants.

29. The apparatus according to claim 20, wherein the message aggregation logic is further configured to convert identifying information pertaining to said at least one participant into an indication of a role played by the participant in the message-passing environment.

30. The apparatus according to claim 20, wherein the message aggregation logic is further configured to combine multiple message traces into said at least one message sequence, each message trace pertaining to one or more messages transmitted by and/or received at a participant.

31. The apparatus according to claim 20, wherein the message aggregation logic is further configured to assemble plural message sequences, and the analysis logic is further configured to analyze the plural message sequences.

32. The apparatus according to claim 20, wherein the analysis logic is configured to perform cluster analysis to group said at least one message sequence into at least one cluster.

33. The apparatus according to claim 32, wherein, in performing the cluster analysis, the analysis logic is further configured to:

form a data matrix based on information in said at least one message sequence; and

form said at least one cluster based on the data matrix.

34. The apparatus according to claim 33, wherein the analysis logic is configured to form the data matrix by extracting features from said at least one message sequence.

35. The apparatus according to claim 33, wherein the analysis logic is configured to form the data matrix by forming a similarity measure which measures the difference between said at least one message sequence and another message sequence.

36. The apparatus according to claim 32, wherein the analysis logic is further configured to identify results of the cluster analysis that may warrant further investigation.

37. The apparatus according to claim 20, wherein the analysis logic is further configured to compare said at least one message sequence with a reference message sequence.

38. A computer readable medium including machine readable instructions for implementing the message aggregation logic, the analysis logic, and the output logic of claim 20.

25. The method according to claim 25, wherein the markup language is the extensible markup language (XML).

39. An apparatus for investigating messages passed in a message-passing environment, comprising:

means for collecting a plurality of messages from at least one participant in the message-passing environment;

means for assembling the messages into at least one message sequence;

means for analyzing said at least one message sequence to extract information regarding the message-passing environment; and

means for outputting the information.