Network transaction discovery

• US 20060287948A1
• Filed: 06/15/2005
• Published: 12/21/2006
• Est. Priority Date: 06/15/2005
• Status: Active Grant

• Current Assignee: BMC Software Incorporated (KKR & Co., Inc.)
• Original Assignee: BMC Software Incorporated (KKR & Co., Inc.)
• Inventors: Ernst, Theodore Russell
• Granted Patent: US 7,996,515 B2
• Time in Patent Office: Days
• US Class Current: 705/39
• CPC Class Codes: G06Q 20/10 specially adapted for electronic funds transfer [EFT] systems; specially adapted for home banking systems
• CPC Class Codes: H04L 43/0876 Network utilisation, e.g. volume of load or congestion level

Abstract

Disclosed herein is a computer implemented technique for discovering the information technology resources that are involved in a particular networked business transaction. The system comprises three basic components. A robotic transaction playback client records the various steps in a particular transaction and can repetitively execute these steps to analyze the results. A network record collector observes the traffic throughout the network in response to the repeated instances of the transaction executed by the robotic transaction playback client. A backend processor analyzes the observations of network traffic to determine which ones are possibly tied to the transaction, and from this information determine which network components are part of the transaction being analyzed. Event timing information from a plurality of executions of a particular transaction are used to determine resource usage and paths.

Claims

1. A system for identifying resources used in a network transaction, the system comprising:

a robotic transaction playback client;

a network record collector; and

a backend processor;

wherein the backend processor analyzes data generated by the network record collector in response to one or more transactions executed by the robotic transaction playback client to identify one or more resources used in the transaction.

2. The system of claim 1 wherein the robotic transaction playback client is configured to replay the transaction at varying times.

3. The system of claim 2 wherein the robotic transaction playback client is configured to replay the transaction under varying network traffic conditions.

4. The system of claim 3 wherein the data generated by the network record collector includes one or more parameters selected from the group consisting of:

originating network address, originating network port, destination network address, destination network port, message size, number of responses to a request, and a timestamp.

5. The system of claim 1 wherein analyzing data generated by the network record collector in response to one or more transactions executed by the robotic transaction playback client to identify one or more resources used in the transaction comprises identifying a plurality of nodes belonging to a single logical group of nodes and identifying any of the plurality as a single node.

6. A method of identifying network resources required by a transaction, the method comprising:

recording the components of the transaction;

executing the recorded transaction one or more times; and

collecting one or more data sets from a plurality of network probes wherein each of the one or more data sets uniquely corresponds to one execution of the recorded transaction; and

analyzing the collected data sets to identify network resources required by the transaction.

7. The method of claim 6 wherein analyzing the collected data further comprises:

identifying a beginning time of the transaction by identifying the time of an initial request sent by a client executing the transaction;

identifying an ending time of the transaction by identifying the time of a response to the initial request; and

identifying a first resource involved in the transaction by identifying the destination of the initial request.

8. The method of claim 7 wherein analyzing the collected data further comprises:

identifying one or more request/response pairs sent/received by the first resource between the beginning time of the transaction and the ending time of the transaction; and

identifying one or more potential additional resources potentially in the transaction by identifying the destination/source of each of the identified request/response pairs.

9. The method of claim 8 further comprising recursively applying the steps of claim 15 to eliminate resources not involved in the transaction.

10. The method of claim 8 wherein identifying one or more potential additional resources further comprises assigning a probability to each potential additional resource.

11. The method of claim 10 wherein the probability is heuristically determined.

12. The method of claim 10 wherein assigning a probability to each potential resource comprises:

identifying a plurality of network paths potentially corresponding to the transaction;

assigning equal base probabilities to each of the plurality of network paths;

analyzing one or more additional parameters relating to network traffic observed on each of the plurality of network paths and flagging each of the plurality of network paths wherein the one or more additional parameters indicate a stronger correlation with the transaction; and

assigning new probabilities to each of the plurality of network paths, wherein the new probability for each flagged path increased and the new probability for each remaining path is decreased relative to the base probabilities.

13. The method of claim 12 wherein assigning new probabilities to each of the plurality of network paths further comprises:

for each flagged network path, increasing the base probability by a predetermined percentage of the base probability multiplied by the number of nodes by which an endpoint of the network path is removed from a client originating the transaction to generate an intermediate probability;

summing the intermediate probabilities for each flagged network path and the base probabilities for each non-flagged network path to obtain a new probability sum; and

assigning a new probability for each network path wherein, for each flagged network path, the new probability is the intermediate probability divided by the new probability sum, and wherein, for each non-flagged network path, the new probability is the base probability divided by the new probability sum.

14. The method of claim 6 wherein analyzing the collected data sets to identify network resources required by the transaction comprises identifying a plurality of nodes belonging to a single logical group of nodes and thenceforth identifying any of the plurality of nodes as a single node.

15. A machine readable medium, having embodied thereon instructions executable by the machine to perform a method according to claim 6.

16. A machine readable medium, having embodied thereon instructions executable by the machine to perform a method according to claim 9.

17. A machine readable medium, having embodied thereon instructions executable by the machine to perform a method according to claim 10.

18. A machine readable medium, having embodied thereon instructions executable by the machine to perform a method according to claim 11.

19. A machine readable medium, having embodied thereon instructions executable by the machine to perform a method according to claim 12.

20. A machine readable medium, having embodied thereon instructions executable by the machine to perform a method according to claim 13.