AUTOMATED GROUPING OF MESSAGES PROVIDED TO AN APPLICATION USING STRING SIMILARITY ANALYSIS

• US 20100169285A1
• Filed: 03/12/2010
• Published: 07/01/2010
• Est. Priority Date: 12/01/2006
• Status: Active Grant

• Current Assignee: CA, Inc. (d/b/a CA Technologies) (Broadcom, Inc.)
• Original Assignee: Computer Associates Think Inc. (Broadcom, Inc.)
• Inventors: Seidman, David Isaiah, Bansal, Jyoti Kumar, Addleman, Mark J.
• Granted Patent: US 8,078,619 B2
• Time in Patent Office: Days
• US Class Current: 707/688
• CPC Class Codes: G06F 11/3612 by runtime analysis performance monitoring G06F11/3466
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]
• CPC Class Codes: H04L 67/56 Provisioning of proxy services store-and-forward switching systems in data switching networks H04L12/54
• CPC Class Codes: H04L 67/566 Grouping or aggregating service requests, e.g. for unified processing
• CPC Class Codes: Y10S 707/99936 Pattern matching access

Abstract

Messages which are provided to an application are monitored. Similarities between the messages are determined based on a distance algorithm, in one approach, and messages which are similar are assigned to a common group. For example, the messages may be HTTP messages which include a URL, HTTP header parameters and/or HTTP post parameters. The messages are parsed to derive a string which is used in the distance calculations. Additionally, application runtime data such as response times is obtained and aggregated for the group. Further, a representative message can be determined for each group for comparison to subsequent messages. Results can be reported which include a group identifier, representative message, count and aggregated runtime data.

Claims

1. A computer-implemented method for classifying messages, comprising:

obtaining a particular string from a particular message sent to an application, the particular message includes a request for the application to perform a transaction, and the application executes in response to the request;

obtaining runtime data regarding execution of the application based on the request, and associating the runtime data with the particular string;

calculating a distance between the particular string and a representative string of each group of a plurality of groups using a message distance algorithm, one of the distances is a minimum distance;

in response to determining that the minimum distance exceeds a threshold, creating a new group and grouping the particular string into the new group as a sole member of the new group initially;

subsequently obtaining an additional string from an additional message sent to the application, the additional message includes an additional request for the application to perform a transaction, and the application executes in response to the additional request;

obtaining additional runtime data, regarding execution of the application based on the additional request, and associating the additional runtime data with the additional string;

calculating an additional distance, using the message distance algorithm, between the additional string and;

(a) the representative string of each group of the plurality of groups, and (b) the particular string in the new group as the sole member of the new group, one of the additional distances is a minimum additional distance; and

grouping the additional string into one group of the plurality of groups and the new group which is associated with the minimum additional distance.

2. The computer-implemented method of claim 1, wherein:

the particular message is sent to the application from a particular web browser and includes a particular URL as a request for a particular web page, the particular URL comprising a host name, file path and at least one parameter, and the application executes in response to the particular URL, including providing the particular web page to the particular web browser; and

the additional message is sent to the application from an additional web browser and includes an additional URL as a request for an additional web page, the additional URL comprising a host name, file path and at least one parameter, and the application executes in response to the additional URL, including providing the additional web page to the additional web browser.

3. The computer-implemented method of claim 2, wherein:

the obtaining a particular string comprises parsing the particular URL; and

the obtaining the additional string comprises parsing the additional URL.

4. The computer-implemented method of claim 2, wherein:

the at least one parameter of the particular URL comprises different header portions, each different header portion comprising at least one of an HTTP query parameter and an HTTP cookie parameter;

the distance between the particular string and the representative string of each group of the plurality of groups is calculated based on a distance between each different header portion of the particular string and the representative string of each group of the plurality of groups;

the at least one parameter of the additional URL comprises different header portions, each different header portion comprising at least one of an HTTP query parameter and an HTTP cookie parameter;

the distance between the additional string and the representative string of each group of the plurality of groups is calculated based on a distance between each different header portion of the additional string and the representative string of each group of the plurality of groups; and

the distance between the additional string and the particular string in the new group is calculated based on a distance between each different header portion of the additional string and the particular string.

5. The computer-implemented method of claim 4, wherein:

the particular string is obtained by a concatenation of header parameters in the particular URL; and

the additional string is obtained by a concatenation of header parameters in the additional URL.

6. The computer-implemented method of claim 4, wherein:

each different header portion of the particular URL comprises an HTTP post parameter; and

each different header portion of the additional URL comprises an HTTP post parameter.

7. The computer-implemented method of claim 2, wherein:

the host name and file path are the same for each of the particular message and the additional message.

8. At least one processor readable storage device having processor readable code embodied thereon for programming at least one processor to perform a method for classifying messages, the method comprising:

obtaining a particular string from a particular message sent to an application, the particular message includes a request for the application to perform a transaction, and the application executes in response to the request;

obtaining runtime data regarding execution of the application based on the request, and associating the runtime data with the particular string;

calculating a distance between the particular string and a representative string of each group of a plurality of groups using a message distance algorithm, one of the distances is a minimum distance;

in response to determining that the minimum distance exceeds a threshold, creating a new group and grouping the particular string into the new group as a sole member of the new group initially;

subsequently obtaining an additional string from an additional message sent to the application, the additional message includes an additional request for the application to perform a transaction, and the application executes in response to the additional request;

obtaining additional runtime data, regarding execution of the application based on the additional request, and associating the additional runtime data with the additional string;

calculating an additional distance, using the message distance algorithm, between the

additional string and;

(a) the representative string of each group of the plurality of groups, and (b) the particular string in the new group as the sole member of the new group, one of the additional distances is a minimum additional distance; and

grouping the additional string into one group of the plurality of groups and the new group which is associated with the minimum additional distance.

9. The at least one processor readable storage device of claim 8, wherein:

the particular message is sent to the application from a particular web browser and includes a particular URL as a request for a particular web page, the particular URL comprising a host name, file path and at least one parameter, and the application executes in response to the particular URL, including providing the particular web page to the particular web browser; and

the additional message is sent to the application from an additional web browser and includes an additional URL as a request for an additional web page, the additional URL comprising a host name, file path and at least one parameter, and the application executes in response to the additional URL, including providing the additional web page to the additional web browser.

10. The at least one processor readable storage device of claim 9, wherein:

the obtaining a particular string comprises parsing the particular URL; and

the obtaining the additional string comprises parsing the additional URL.

11. The at least one processor readable storage device of claim 9, wherein:

the at least one parameter of the particular URL comprises different header portions, each different header portion comprising at least one of an HTTP query parameter and an HTTP cookie parameter;

the distance between the particular string and the representative string of each group of the plurality of groups is calculated based on a distance between each different header portion of the particular string and the representative string of each group of the plurality of groups;

the at least one parameter of the additional URL comprises different header portions, each different header portion comprising at least one of an HTTP query parameter and an HTTP cookie parameter;

the distance between the additional string and the representative string of each group of the plurality of groups is calculated based on a distance between each different header portion of the additional string and the representative string of each group of the plurality of groups; and

the distance between the additional string and the particular string in the new group is calculated based on a distance between each different header portion of the additional string and the particular string.

12. The at least one processor readable storage device of claim 11, wherein:

the particular string is obtained by a concatenation of header parameters in the particular URL; and

the additional string is obtained by a concatenation of header parameters in the additional URL.

13. The at least one processor readable storage device of claim 11, wherein:

each different header portion of the particular URL comprises an HTTP post parameter; and

each different header portion of the additional URL comprises an HTTP post parameter.

14. The at least one processor readable storage device of claim 9, wherein:

the host name and file path are the same for each of the particular message and the additional message.

15. At least one processor readable storage device having processor readable code embodied thereon for programming at least one processor to perform a method for classifying messages, the method comprising:

monitoring a plurality of messages which are sent to an application from web browsers, each message includes a URL comprising a host name, file path and at least one parameter, at least one message of the plurality of messages is a request from an associated web browser for a web page, and the application executes in response to each URL, including providing the web page to the associated web browser based on the at least one message;

parsing each URL to obtain a string from each URL;

for each URL, obtaining runtime data regarding execution of the application, and associating the runtime data with the string of the URL;

calculating a distance between the URL of each message and the URL of each other message of the plurality of messages by comparing the string of each URL and the strings of each other URL of the plurality of messages using a message distance algorithm;

grouping the strings according to the distances into a plurality of groups; and

for each group, aggregating the runtime data which is associated with the strings which are associated with the group, so that aggregated runtime data is provided for each group of the plurality of groups.

16. The at least one processor readable storage device of claim 15, wherein:

the host name and file path are the same for each of the plurality of messages.

17. The at least one processor readable storage device of claim 15, wherein:

for at least one of the URLs, the string is obtained by a concatenation of header parameters.

18. The at least one processor readable storage device of claim 15, wherein:

the comparing the string of each URL and the strings of each other URL of the plurality of messages comprises comparing the at least one header parameter of each URL to the at least one header parameter of each other URL of the plurality of messages.

19. The at least one processor readable storage device of claim 15, wherein:

the at least one header parameter which is compared comprises at least one of a query parameter and a cookie parameter.

20. The at least one processor readable storage device of claim 15, wherein:

the at least one header parameter which is compared comprises a query parameter and a cookie parameter.