AUTOMATED GROUPING OF MESSAGES PROVIDED TO AN APPLICATION USING STRING SIMILARITY ANALYSIS

• US 20080134209A1
• Filed: 12/01/2006
• Published: 06/05/2008
• Est. Priority Date: 12/01/2006
• Status: Active Grant

• Current Assignee: CA, Inc. (d/b/a CA Technologies) (Broadcom, Inc.)
• Original Assignee: Computer Associates Think Inc. (Broadcom, Inc.)
• Inventors: Seidman, David Isaiah, Bansal, Jyoti Kumar, Addleman, Mark J.
• Granted Patent: US 7,689,610 B2
• Time in Patent Office: Days
• US Class Current: 719/317
• CPC Class Codes: G06F 11/3612 by runtime analysis performance monitoring G06F11/3466
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]
• CPC Class Codes: H04L 67/56 Provisioning of proxy services store-and-forward switching systems in data switching networks H04L12/54
• CPC Class Codes: H04L 67/566 Grouping or aggregating service requests, e.g. for unified processing
• CPC Class Codes: Y10S 707/99936 Pattern matching access

Abstract

Messages which are provided to an application are monitored. Similarities between the messages are determined based on a distance algorithm, in one approach, and messages which are similar are assigned to a common group. For example, the messages may be HTTP messages which include a URL, HTTP header parameters and/or HTTP post parameters. The messages are parsed to derive a string which is used in the distance calculations. Additionally, application runtime data such as response times is obtained and aggregated for the group. Further, a representative message can be determined for each group for comparison to subsequent messages. Results can be reported which include a group identifier, representative message, count and aggregated runtime data.

Claims

1. A computer-implemented method for classifying messages, comprising:

obtaining strings from messages sent to an application;

calculating metrics for each message which represent distances between each message'"'"'s string and strings of other messages; and

grouping the messages according to the metrics into a plurality of groups.

2. The computer-implemented method of claim 1, wherein:

the messages are grouped so that messages whose distance from one another is less than a threshold are grouped together.

3. The computer-implemented method of claim 1, wherein:

the messages are grouped so that each of the plurality of groups has a similar number of messages.

4. The computer-implemented method of claim 1, wherein:

the metrics are calculated using a predetermined number of characters in the strings.

5. The computer-implemented method of claim 1, wherein:

the strings for which the metrics are calculated comprise uniform resource identifiers.

6. The computer-implemented method of claim 1, wherein:

the strings for which the metrics are calculated comprise at least one of HTTP header parameters and HTTP post parameters.

7. The computer-implemented method of claim 1, wherein:

the strings for which the metrics are calculated comprise uniform resource identifiers and at least one of HTTP header parameters and HTTP post parameters.

8. The computer-implemented method of claim 1, wherein:

the messages are grouped according to the metrics into a hierarchy of groups.

9. The computer-implemented method of claim 1, wherein:

the metrics include first metrics which represent distances between uniform resource identifiers of the strings and second metrics which represent distances between at least one of HTTP header parameters and HTTP post parameters of the strings.

10. The computer-implemented method of claim 9, wherein:

the messages are grouped into a first level of a hierarchy of groups based on the first metrics, and into a second level of the hierarchy of groups based on the second metrics.

11. The computer-implemented method of claim 1, further comprising:

providing a representative message string for at least one of the groups.

12. The computer-implemented method of claim 1, further comprising:

providing a representative message string for at least one of the groups by determining a message in the group for which a sum of the distances relative to other message strings in the at least one of the groups is a minimum.

13. The computer-implemented method of claim 1, further comprising:

reporting, responsive to the grouping of the messages.

14. The computer-implemented method of claim 13, wherein:

the reporting identifies a count of messages grouped into each of the plurality of groups.

15. A computer-implemented method for classifying messages, comprising:

obtaining a string from a message sent to an application;

calculating metrics for the message which represent distances between the string and representative strings of each of a plurality of different groups; and

grouping the message into one of the different groups for which the metric represents a minimum distance.

16. The computer-implemented method of claim 15, wherein:

the strings for which the metrics are calculated comprise uniform resource identifiers.

17. The computer-implemented method of claim 15, wherein:

the strings for which the metrics are calculated comprise at least one of HTTP header parameters and HTTP post parameters.

18. The computer-implemented method of claim 15, wherein:

the representative strings are set based on a learning period in which messages sent to the application are grouped.

19. A computer-implemented method for classifying messages, comprising:

obtaining a string from a message sent to an application;

calculating metrics for the message which represent distances between the string and representative strings of each of a plurality of different groups, one of the metrics representing a minimum distance;

if the metric which represents the minimum distance exceeds a threshold, grouping the message into a new group; and

if the metric which represents the minimum distance does not exceed the threshold, grouping the message into one of the different groups for which the metric represents the minimum distance.

20. The computer-implemented method of claim 19, wherein:

the strings for which the metrics are calculated comprise uniform resource identifiers.

21. The computer-implemented method of claim 19, wherein:

the strings for which the metrics are calculated comprise at least one of HTTP header parameters and HTTP post parameters.

22. At least one processor readable storage device having processor readable code embodied thereon for programming at least one processor to perform a method, the method comprising:

obtaining strings from messages sent to an application;

calculating metrics for each message which represent distances between each message'"'"'s string and strings of other messages; and

grouping the messages according to the metrics into a plurality of groups.

23. The at least one processor readable storage device of claim 22, wherein:

the strings for which the metrics are calculated comprise uniform resource identifiers.

24. The at least one processor readable storage device of claim 22, wherein:

the strings for which the metrics are calculated comprise at least one of HTTP header parameters and HTTP post parameters.

25. The at least one processor readable storage device of claim 22, wherein:

the strings for which the metrics are calculated comprise uniform resource identifiers and at least one of HTTP header parameters and HTTP post parameters.

26. At least one processor readable storage device having processor readable code embodied thereon for programming at least one processor to perform a method, the method comprising:

obtaining a string from a message sent to an application;

calculating metrics for the message which represents distances between the string and representative strings of different groups; and

grouping the message into one of the different groups for which the metric represents a minimum distance.

27. The at least one processor readable storage device of claim 26, wherein:

the strings for which the metrics are calculated comprise uniform resource identifiers.

28. The at least one processor readable storage device of claim 26, wherein:

the strings for which the metrics are calculated comprise at least one of HTTP header parameters and HTTP post parameters.

29. The at least one processor readable storage device of claim 26, wherein:

the representative strings are set based on a learning period in which messages sent to the application are grouped.

30. At least one processor readable storage device having processor readable code embodied thereon for programming at least one processor to perform a method, the method comprising:

obtaining a string from a message sent to an application;

calculating metrics for the message which represent distances between the string and representative strings of each of a plurality of different groups, one of the metrics representing a minimum distance;

if the metric which represents the minimum distance exceeds a threshold, grouping the message into a new group; and

if the metric which represents the minimum distance does not exceed the threshold, grouping the message into one of the different groups for which the metric represents the minimum distance.

31. The at least one processor readable storage device of claim 30, wherein:

the strings for which the metrics are calculated comprise uniform resource identifiers.

32. The at least one processor readable storage device of claim 30, wherein:

the strings for which the metrics are calculated comprise at least one of HTTP header parameters and HTTP post parameters.