Web Traffic Analysis Tool

• US 20110016141A1
• Filed: 09/28/2010
• Published: 01/20/2011
• Est. Priority Date: 04/15/2008
• Status: Abandoned Application

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Bar-Caspi, Doron, Zhu, Kai, Ami-Ad, Kfir, Wise, Michael Anthony, Winter, Daniel K., Sui, Yi, Cai, Wenyu, Kalligerakis, Demetrios
• Application Number:
  US12/891,826
• Publication Number:
  US 20110016141A1
• Time in Patent Office: Days
• US Class Current: 707/758
• CPC Class Codes: A61K 38/00 Medicinal preparations containing peptides peptides containing beta-lactam rings A61K31/00; cyclic dipeptides not having in their molecule any other peptide link than those which form their ring, e.g. piperazine-2,5-diones, A61K31/00; ergot alkaloids of the cyclic peptide type A61K31/48; containing macromolecular compounds having statistically distributed amino acid units A61K31/74; medicinal preparations containing antigens or antibodies A61K39/00; medicinal preparations characterised by the non-active ingredients, e.g. peptides as drug carriers, A61K47/00
• CPC Class Codes: A61P 21/00 Drugs for disorders of the muscular or neuromuscular system
• CPC Class Codes: A61P 25/28 for treating neurodegenerative disorders of the central nervous system, e.g. nootropic agents, cognition enhancers, drugs for treating Alzheimer's disease or other forms of dementia
• CPC Class Codes: C07K 14/515 Angiogenesic factors; Angiogenin

Abstract

A log file may include a line corresponding to a request received at a web server. A rules file may include rules that are applied in a specified order. The rules may include a first rule associated with a first request identifier and a second rule associated with a second request identifier. A determination is made as to whether the line matches the first rule. If the line matches the first rule, then identification data is updated to associate the first request identifier with the line. If the line does not match the first rule, then a determination is made as to whether the line matches the second rule. If the line matches the second rule, then the identification data is updated to associate the second request identifier with the line. If the line does not match the second rule, additional rules in the rules may be similarly applied

Claims

1. A computer-implemented method for analyzing web traffic, the method comprising computer-implemented operations for:

receiving a log file including a line, the line corresponding to a request received at a web server;

receiving a rules file including a sequence of rules that are applied in a specified order, the sequence of rules associated with a plurality of request identifiers, the sequence of rules including a first rule associated with a first request identifier and a second rule associated with a second request identifier;

determining whether the line matches the first rule;

in response to determining that the line matches the first rule, updating identification data to associate the first request identifier with the line;

in response to determining that the line does not match the first rule, determining whether the line matches the second rule; and

in response to determining that the line matches the second rule, updating the identification data to associate the second request identifier with the line.

2. The computer-implemented method of claim 1, wherein log file further includes a second line, the second line corresponding to a second request received at the web server;

and the method comprising further computer-implemented operations for;

upon updating the identification data to associate the first request identifier with the line, determining whether the second line matches the first rule;

in response to determining that the second line matches the first rule, updating identification data to associate the first request identifier with the second line;

in response to determining that the second line does not match the first rule, determining whether the second line matches the second rule; and

in response to determining that the second line matches the second rule, updating the identification data to associate the second request identifier with the second line.

3. The computer-implemented method of claim 1, wherein the first rule includes a plurality of field conditions;

and wherein determining whether the line matches the first rule comprises determining whether the line satisfies each of the plurality of field conditions.

4. The computer-implemented method of claim 1, wherein the first rule includes a plurality of field conditions;

and wherein determining whether the line matches the first rule comprises determining whether the line satisfies at least one of the plurality of field conditions.

5. The computer-implemented method of claim 1, wherein the line includes a plurality of values, each of the plurality of values corresponding to one of a plurality of fields;

wherein the first rule includes a field element identifying a field from the plurality of fields, a predicate element specifying a predicate, and a pattern element specifying a pattern; and

wherein determining whether the line matches the first rule comprises;

extracting the field, the predicate, and the pattern from the first rule;

retrieving a value from the plurality of values corresponding to the extracted field; and

determining whether the retrieved value and the extracted pattern have a relation according to the extracted predicate.

6. The computer-implemented method of claim 5, wherein the value comprises a number, and the pattern comprises a number.

7. The computer-implemented method of claim 5, wherein the value comprises a string, and the pattern comprises a string.

8. The computer-implemented method of claim 1, the method comprising further computer-implemented operations for generating an output file based on the identification data.

9. The computer-implemented method of claim 8, wherein the output file associates a count and a ratio with each of the plurality of request identifiers, the count specifying a number of times that a corresponding request is received at the web server, the ratio specifying the number of times that the corresponding request is received at the web server in relation to a total number of requests received at the web server.

10. The computer-implemented method of claim 1, wherein the first rule and the second rule are encoded in Extensible Markup Language (XML).

11. A computer system, comprising:

a processor;

a memory communicatively coupled to the processor; and

a web traffic analysis tool (i) which executes in the processor from the memory and (ii) which, when executed by the processor, causes the computer system to analyze web traffic by

receiving a log file including a first line and a second line, the first line corresponding a first request received at a web server, the second line corresponding to a second request received at the web server,

receiving a rules file including a sequence of rules that are applied in a specified order, the sequence of rules associated with a plurality of request identifiers, the sequence of rules including a first rule associated with a first request identifier and a second rule associated with a second request identifier,

determining whether the first line matches the first rule,

in response to determining that the first line matches the first rule, updating identification data to associate the first request identifier with the first line,

in response to determining that the first line does not match the first rule, determining whether the first line matches the second rule,

in response to determining that the first line matches the second rule, updating the identification data to associate the second request identifier with the first line,

upon updating the identification data to associate the first request identifier with the first line, determining whether the second line matches the first rule,

in response to determining that the second line matches the first rule, updating identification data to associate the first request identifier with the second line,

in response to determining that the second line does not match the first rule, determining whether the second line matches the second rule, and

in response to determining that the second line matches the second rule, updating the identification data to associate the second request identifier with the second line.

12. The computer system of claim 11, wherein the log file comprises a text file or a binary file.

13. The computer system of claim 11, wherein the first line and the second line are separated by a carriage return (CR) or a carriage return line feed (CRLF).

14. The computer system of claim 11, wherein the first rule includes a plurality of field conditions;

wherein determining whether the first line matches the first rule comprises determining whether the first line satisfies each of the plurality of field conditions; and

wherein determining whether the second line matches the second rule comprises determining whether the second line satisfies each of the plurality of field conditions.

15. The computer system of claim 11, wherein the first rule includes a plurality of field conditions;

wherein determining whether the first line matches the first rule comprises determining whether the first line satisfies at least one of the plurality of field conditions; and

wherein determining whether the second line matches the second rule comprises determining whether the second line satisfies at least one of the plurality of field conditions.

16. The computer system of claim 11, wherein the first line includes a plurality of values, each of the plurality of values corresponding to one of a plurality of fields;

wherein the first rule includes a field element identifying a field from the plurality of fields, a predicate element specifying a predicate, and a pattern element specifying a pattern; and

wherein determining whether the first line matches the first rule comprises;

extracting the field, the predicate, and the pattern from the first rule;

retrieving a value from the plurality of values corresponding to the extracted field; and

determining whether the retrieved value and the extracted pattern have a relation according to the extracted predicate.

17. The computer system of claim 16, wherein each of the plurality of values in the first line are separated by whitespace.

18. The computer system of claim 11, wherein the web traffic analysis tool, when executed by the processor, further causes the computer system to analyze web traffic by generating an output file based on the identification data, the output file associating a count and a ratio with each of the plurality of request identifiers, the count specifying a number of times that a corresponding request is received at the web server, the ratio specifying the number of times that the corresponding request is received at the web server in relation to a total number of requests received at the web server.

19. A computer-readable storage medium having computer-executable instructions stored thereon which, when executed by a computer, cause the computer to:

receiving a log file including a first line and a second line, the first line corresponding a first request received at a web server, the second line corresponding to a second request received at the web server,

receive a rules file including a sequence of rules that are applied in a specified order, the sequence of rules associated with a plurality of request identifiers, the sequence of rules including a first rule associated with a first request identifier and a second rule associated with a second request identifier, the first rule comprising a first set of field conditions, the second rule comprising a second set of field conditions;

determine whether the first line matches the first rule by determining whether the first line satisfies each of the first set of field conditions;

in response to determining that the first line matches the first rule, update identification data to associate the first request identifier with the first line;

in response to determining that the first line does not match the first rule, determine whether the first line matches the second rule by determining whether the first line satisfies each of the second set of field conditions;

in response to determining that the first line matches the second rule, update the identification data to associate the second request identifier with the first line;

upon updating the identification data to associate the first request identifier with the line, determine whether the second line matches the first rule by determining whether the second line satisfies each of the first set of field conditions;

in response to determining that the second line matches the first rule, update identification data to associate the first request identifier with the second line;

in response to determining that the second line does not match the first rule, determine whether the second line matches the second rule by determining whether the second line satisfies each of the second set of field conditions; and

in response to determining that the second line matches the second rule, update the identification data to associate the second request identifier with the second line.

20. The computer-readable storage medium of claim 19, wherein the first line includes a plurality of values, each of the plurality of values corresponding to one of a plurality of fields;

wherein the first set of field conditions comprises a first field condition and a second field condition;

wherein the first field condition includes a first field element identifying a first field from the plurality of fields, a first predicate element specifying a first predicate, and a first pattern element specifying a first pattern;

wherein the second field condition includes a second field element identifying a second field from the plurality of fields, a second predicate element specifying a second predicate, and a second pattern element specifying a second pattern; and

wherein to determine whether the first line matches the first rule, the computer-readable storage medium having further computer-executable instructions stored thereon which, when executed by the computer, cause the computer to;

extract the first field, the first predicate, and the first pattern from the first field condition;

retrieve a first value from the plurality of values corresponding to the extracted first field;

determine whether the retrieved first value and the extracted first pattern have a first relation according to the extracted first predicate;

extract the second field, the second predicate, and the second pattern from the second field condition;

retrieve a second value from the plurality of values corresponding to the extracted second field; and

determine whether the retrieved second value and the extracted second pattern have a second relation according to the extracted second predicate.