Generic, multi-instance method and GUI detection system for tracking and monitoring computer applications

• US 20070083813A1
• Filed: 10/11/2005
• Published: 04/12/2007
• Est. Priority Date: 10/11/2005
• Status: Active Grant

• Current Assignee: KNOA Software Incorporated
• Original Assignee: KNOA Software Incorporated
• Inventors: Lui, Philip, Kopytnik, Zbigniew, Rayna, David
• Granted Patent: US 8,079,037 B2
• Time in Patent Office: Days
• US Class Current: 715/709
• CPC Class Codes: G06F 11/3612 by runtime analysis performance monitoring G06F11/3466
• CPC Class Codes: G06F 11/3636 by tracing the execution of the program

Abstract

Presented is a system and method for monitoring events derived from a computer target application presentation layer including the steps of providing, independent of recompiling the target application'"'"'s source code, a script running at a level within the target application. The script scans run-time instantiations of objects of the target application, and allocates structures in real-time to the object instantiations. These allocated structures are adapted to create a reflection of the target application structure, which is used along with detected object instantiations that match a predetermined object structure to capture a portion of an environmental spectrum of the detected object. Further, the system can process state machine events occurring on at least one of a server machine and a client/localized machine, correlate the state machine events with the environmental spectrum, and deduce a user experience based on the correlated state machine events.

Claims

1. A method for monitoring events derived from a presentation layer and software methods of a target application, comprising the steps of:

providing, independent of recompiling a source code of the target application, a script operable to run at a level within the target application, wherein the target application has a structure;

scanning run-time instantiations of objects including method-calls, method-returns, and GUI objects of the target application;

allocating structures in real-time to the object instantiations;

adapting the allocated structures to create a reflection of the target application structure;

detecting one or more object instantiations that match a predetermined object structure; and

capturing at least a portion of an environmental spectrum of the detected object.

2. The method of claim 1, further comprising the steps of:

processing the captured environmental spectrum of the detected object into logical events;

reassembling the logical events to reflect multi-instantiation structures within distinct contexts, wherein the distinct contexts are prior states of the target application; and

correlating the reassembled multi-instantiation structures to analyze the prior state of the target application.

3. The method of claim 1, wherein the captured environmental spectrum includes categories of information concerning the detected object, wherein the information provides insight about the target application environment.

4. The method of claim 1, wherein the scanning step further comprises the step of selecting object instantiations based on at least one predefined monitoring criterion.

5. The method of claim 1, wherein the providing step provides the script on a client computer.

6. The method of claim 1, further comprising the step of:

sharing the reflection of the target application structure among a plurality of scripts, wherein each of the plurality of scripts is associated with a respective instantiation of the target application;

wherein the reflection of the target application structure provides a GUI context for collected tracking data.

7. The method of claim 1, further comprising the steps of:

detecting generic instantiations of the objects using script expressions capable of detecting categories of related objects; and

processing the contents and properties of the detected generic object instantiations to determine, the occurrence of target application events in context.

8. The method of claim 7, further comprising the step of building user contexts by using track-message level, and predefined, semantics and conventions.

9. The method of claim 1, further comprising the steps of:

declaring a hierarchical organizing entity that represents a portion of the target application and contains contextual information from at least the captured environmental spectrum; and

analyzing the captured environmental spectrum supported by the hierarchical organizing entity.

10. The method of claim 9, including the additional the step of evaluating a context level value to distinguish among multiple object instantiations during execution of the target application.

11. The method of claim 2, wherein there are multiple instantiations of the target application, the scanning step scans each target application instantiation and the detecting step detects object instantiations concerning more than one instantiation of the target application.

12. The method of claim 11, wherein the capturing step captures contents of detected objects from any target application instantiation.

13. The method of claim 4, wherein the script on the client computer is local to the target application.

14. The method of claim 1, further comprising the step of:

sensing at least one of a target application interaction with a user and a target application generated-event;

selectively generating events based on execution of the script in response to the results of the sensing step;

passing one or more of the generated events to an interpreter;

analyzing the selectively generated events; and

correlating the analysis by functional mapping to external sources.

15. The method of claim 14, further comprising the step of generating at least one of reports, alerts, correlations, and responses containing results of the analyzing and correlating steps.

16. The method of claim 1, wherein the scanning, allocating, adapting, detecting and capturing steps are repeated at a predetermined interval to create an updated reflection of the target application.

17. The method of claim 1, wherein the scanning, allocating, adapting, detecting and capturing steps are invoked by detected events to create an updated reflection of the target application.

18. The method of claim 1, further comprising the steps of:

associating the script with a single process of a window in the target application;

detecting a message associated with a thread id;

intercepting the message by an active hook routine in the script;

evaluating the contents of the message; and

deriving events and properties from the message to obtain information on the target application.

19. A method for analyzing method events, comprising the steps of:

providing a free-standing monitoring program, said monitoring program operable to model objects of an application window and identify objects to be monitored based on predetermined monitoring criteria;

deriving an indication of an environmental spectrum for the application window;

processing state machine events occurring on at least one of a server machine and a client/localized machine;

correlating the state machine events with the derived environmental spectrum indications;

deducing an indication of a user experience based on the correlating step results; and

reporting the deduced indications to a system user.

20. The method of claim 19, wherein the deducing step is based on indicators received by the server side.

21. The method of claim 20, wherein the correlating step further comprises gathering logical event data from the state machine events that is synergetic with the environmental spectrum indications.

22. The method of claim 19, wherein the free-standing monitoring program includes instructions operable to perform the steps of:

identifying byte opcode patterns;

detecting at least one interface function among the identified byte opcode patterns that provides interfaces to events and properties of an application process, the application window, or window GUI objects;

determining an address of the detected interface function; and

linking to the detected interface function by using a call intercept routine;

wherein a call to the detected interface function is tracked.

23. The method of claim 22, wherein the linking step uses a return intercept function wherein a return is tracked.

24. The method of claim 22, wherein the free-standing monitoring program further includes instructions operable to perform the step of handling a generic function intercept in a manner different from the manner of handling a specific function intercept;

wherein the generic function intercept does not require pre-knowledge of the parameters and format of the detected interface function

25. The method of claim 22, wherein the free-standing monitoring program further includes instructions operable to perform the step of handling a generic function intercept in a manner different from the manner of handling a specific function intercept;

wherein a specific function intercept does contain an indication of published parameters and a format of the detected interface function and the specific function intercept enables direct use of the detected interface function parameters in a script.

26. The method of claim 22, further comprising the step of:

passing instance information for a method call by using an instance information register;

wherein a stack in a host application is not modified, and the instance information register contains a pointer to instance information of a calling function to preserve Method call contexts.

27. A system for monitoring events in a presentation layer of a computer target application, having a predetermined structure, comprising:

a server and a client computer interconnected on a communication network;

a monitoring program executing on the server that includes a script operable to run at a level below the presentation layer;

the monitoring program operable to perform the steps of;

scanning run-time instantiations of objects of the target application;

allocating structures in real-time to the object instantiations;

adapting the allocated structures to create a reflection of the target application structure;

detecting one or more object instantiations that match a predetermined object structure; and

capturing at least the contents of the detected objects.

28. The system of claim 27, wherein the script is present on a computer local to the target application.

29. The system of claim 28, wherein the client computer is one of a personal computer, a workstation, a personal digital assistant, and a platform capable of executing computer operating instructions.

30. A method of monitoring a host application functionality, comprising the steps of:

identifying byte opcode patterns representing method functions within the host application;

determining an address for at least one of the method functions;

linking, using the address, the method function to a call intercept routine and to an information structure instance; and

monitoring returns from calls to the method function with stack manipulations.

31. The method of claim 30, wherein the linking step includes using a jump routine instruction.