SYSTEM, METHOD AND COMPUTER PROGRAM PRODUCT FOR ANALYZING DATA FROM NETWORK-BASED STRUCTURED MESSAGE STREAM

• US 20090193114A1
• Filed: 10/29/2008
• Published: 07/30/2009
• Est. Priority Date: 05/18/2001
• Status: Active Grant

• Current Assignee: Chemtron Research LLC (Intellectual Ventures LLC)
• Original Assignee: Network Resonance Incorporated
• Inventors: Rescorla, Eric Kenneth, Dick, Kevin Stewart
• Granted Patent: US 7,979,539 B2
• Time in Patent Office: Days
• US Class Current: 709/224
• CPC Class Codes: G06F 9/542 Event management; Broadcasting; Multicasting; Notifications
• CPC Class Codes: H04L 69/06 Notations for structuring of protocol data, e.g. abstract syntax notation one [ASN.1]
• CPC Class Codes: H04L 9/40 Network security protocols

Abstract

A system, method and computer program product for analyzing data from a message stream, are disclosed. Data in a structured format is captured from a message stream. The captured data is processed to conform to a data model format so that one or more events can be identified from an analysis of the processed data. Once an event has been identified, the message stream is monitored to detect the identified event. When detected, the event is exported via a network.

Claims

1. A computer implemented method, comprising:

capturing messages in a message stream;

extracting structured data from the captured messages indicating semantic relationships contained in the captured messages;

processing the extracted data to conform to a local data model indicating one or more of the semantic relationships of an individual captured message and to conform to a global data model indicating one or more of the semantic relationships between a plurality of the captured messages, the processing to conform to the global data model including performing a dependency analysis on at least one variable based on the semantic relationships and building an approximation of an analytic PDF;

analyzing the processed data to identify a pattern corresponding to an event; and

detecting the pattern in subsequently captured messages to identify a subsequent occurrence of the event.

2. The method of claim 1, wherein the structured data is in an extensible markup language format.

3. The method of claim 1, wherein the local and global data models comprise data cubes.

4. The method of claim 1, wherein the messages are captured at an edge of an enterprise network.

5. The method of claim 1, wherein the event is derived from the local data model.

6. The method of claim 5, wherein the pattern is detected in real time.

7. The method of claim 1, wherein the analyzing of the processed data to identify a pattern corresponding to an event includes applying at least one statistical modeling technique to the processed data.

8. The method of claim 7, wherein the applied statistical modeling techniques is selected dynamically.

9. The method of claim 1, wherein the processed data is stored in a data store.

10. The method of claim 1, further comprising exporting the identified event via a network.

11. The method of claim 10, wherein a user is permitted to select at least one location connected to the network to which the identified event is exported.

12. A computer system, comprising:

a filter that captures messages in a message stream;

a data extractor that extracts structured data from the captured messages, the structured data indicating semantic relationships contained in the captured messages;

a local builder that processes the extracted data to conform to a local data model indicating one or more of the semantic relationships of an individual captured message;

a global builder that processes the extracted data to conform to a global data model indicating one or more of the semantic relationships between a plurality of the captured messages, the global builder having a dependency builder that performs a dependency analysis on at least one variable based on the semantic relationships and an approximator that builds an approximation of an analytic PDF;

an analysis framework that analyzes the processed data to identify a pattern corresponding to an event; and

a detector that detects the pattern in subsequently captured messages to identify a subsequent occurrence of the event.

13. The system of claim 12, wherein the structured data is in an extensible markup language format.

14. The system of claim 12, wherein the data model comprises a data cube.

15. The system of claim 12, wherein the event comprises a local event derived from the local data model.

16. The system of claim 12, wherein the filter, data extractor and the local builder are provided in a capture device.

17. The system of claim 12, wherein the global builder and analysis framework are provided in a processing device.

18. The system of claim 12, wherein the detector includes a local even detector located at an edge of an enterprise network.

19. A computer program product comprising a computer storage medium having computer code capable of being read by a computer for causing the computer to perform a method comprising:

capturing messages in a message stream;

extracting structured data from the captured messages indicating semantic relationships contained in the captured messages;

processing the extracted data to conform to a local data model indicating one or more of the semantic relationships of an individual captured message and to conform to a global data model indicating one or more of the semantic relationships between a plurality of the captured messages, the processing to conform to the global data model including performing a dependency analysis on at least one variable based on the semantic relationships and building an approximation of an analytic PDF;

analyzing the processed data to identify a pattern corresponding to an event;

detecting the pattern in subsequently captured messages to identify a subsequent occurrence of the event.

20. The computer program product of claim 19, wherein the structured data is in an extensible markup language format.