TRACKING HIGH-LEVEL NETWORK TRANSACTIONS

• US 20110029657A1
• Filed: 07/30/2009
• Published: 02/03/2011
• Est. Priority Date: 07/30/2009
• Status: Active Grant

• Current Assignee: Micro Focus LLC (Open Text Corporation)
• Original Assignee: Hewlett-Packard Development Company, L.P. (HP Inc.)
• Inventors: GUETA, Yaron, Ofek, Shachar
• Granted Patent: US 8,676,965 B2
• Time in Patent Office: Days
• US Class Current: 709/224
• CPC Class Codes: H04L 43/026 using flow identification
• CPC Class Codes: H04L 43/028 by filtering
• CPC Class Codes: Y02D 30/50 in wire-line communication networks, e.g. low power modes or reduced link rate

Abstract

A system and method of tracking high-level network transactions. At least one switching node on a network may collect low-level data packets, the low-level data packets forming collectively a corresponding stream of high-level messages as parts of high-level transactions involving network resources of the network. Identifiers of the network resources in the network serving the high-level transactions may be identified from the low-level data packets. The data content of the high-level messages may be determined. The high-level messages may be grouped into groups of high-level messages having similar data content. Commonalities in the occurrences of high-level messages having different data content may then be identified.

Claims

1. A method of tracking high-level network transactions performed by a transaction-tracking system comprising:

collecting at at least one switching node on a network low-level data packets, the low-level data packets forming collectively a corresponding stream of high-level messages as parts of high-level transactions involving network resources of the network;

identifying from the low-level data packets identifiers of the network resources in the network serving the high-level transactions;

determining the data content of the high-level messages;

grouping the high-level messages into groups of high-level messages having similar data content; and

identifying commonalities in the occurrences of high-level messages having different data content.

2. The method of claim 1, wherein identifying resources includes

comparing data in the collected low-level data packets to data patterns in a library of data patterns of network resources;

and

assigning each low-level data packet to one of the potential given network resources to which the data pattern of the low-level data packet is similar.

3. The method of claim 2, wherein identifying resources further includes constructing high-level messages from the low-level data packets assigned to the same network resource.

4. The method of claim 1, wherein grouping the high-level messages into groups includes assigning a high-level message type to each group of the high-level messages having similar data content.

5. The method of claim 4, where a high-level message that is of a given message type has a corresponding message attribute, and wherein grouping the high-level messages into groups includes mapping each high-level message to a given high-level message type when the high-level message has a high-level message attribute that is similar to the corresponding high-level message attribute of the given high-level message type.

6. The method of claim 5, wherein the high-level message attribute includes a message template, variable message fields, or both message template and variable message fields.

7. The method of claim 1, wherein identifying a series of network resources for each group of high-level messages includes identifying a common sequence of high-level message types in high-level transactions, and assigning the identified common sequence of high-level message types as the transaction flow through the network for an associated high-level transaction.

8. A system for tracking high-level network transactions comprising:

at least one data sniffer configured to be coupled to a corresponding switching node of a network for collecting at the switching node low-level data packets, the low-level data packets forming collectively a corresponding stream of high-level messages as parts of high-level transactions involving network resources of the network; and

a transaction-analysis component configured to be coupled to the network for communicating with the at least one data sniffer;

the transaction-analysis component and the at least one data sniffer being further configured collectively for

identifying from the low-level data packets identifiers of the network resources serving the high-level transactions;

determining the data content of the high-level messages;

grouping the high-level messages into groups of high-level messages having similar data content; and

identifying commonalities in the occurrences of high-level messages having different data content.

9. The system of claim 8, wherein identifying resources includes comparing data in the collected low-level data packets to data patterns in a library of data patterns of network resources;

and assigning each low-level data packet to one of the potential given network resources to which the data pattern of the low-level data packet is similar.

10. The system of claim 9, wherein identifying resources further includes constructing high-level messages from the low-level data packets assigned to the same network resource.

11. The system of claim 8, wherein grouping the high-level messages into groups includes assigning a high-level message type to each group of the high-level messages having similar data content.

12. The system of claim 11, where a message that is of a given message type has a corresponding message attribute, and wherein grouping the high-level messages into groups of high-level messages having the same high-level message type includes mapping each high-level message to a given high-level message type when the high-level message has a message attribute that is similar to the corresponding message attribute of the given high-level message type.

13. The system of claim 12, wherein the message attribute includes a message template, variable message fields, or both message template and variable message fields.

14. The system of claim 8, wherein identifying a series of network resources for each group of high-level messages includes identifying a common sequence of message types in high-level transactions, and assigning the identified common sequence of message types as the transaction flow through the network for an associated high-level transaction.

15. A computer-readable storage device readable by one or more computers and having embodied therein a program of computer-readable instructions that, when executed by the one or more computers, provide for:

collecting at at least one switching node on a network low-level data packets, the low-level data packets forming collectively a corresponding stream of high-level messages as parts of high-level transactions involving network resources of the network;

identifying from the low-level data packets identifiers of the network resources in the network serving the high-level transactions;

determining the data content of the high-level messages;

grouping the high-level messages into groups of high-level messages having similar data content; and

identifying commonalities in the occurrences of high-level messages having different data content.

16. The computer-readable storage device of claim 15, wherein the program of computer-readable instructions provides further for comparing data in the collected low-level data packets to data patterns in a library of data patterns of network resources;

and assigning each low-level data packet to one of the potential given network resources to which the data pattern of the low-level data packet is similar.

17. The computer-readable storage device of claim 16, wherein the program of computer-readable instructions provides further for constructing high-level messages from the low-level data packets assigned to the same network resource.

18. The computer-readable storage device of claim 15, wherein the program of computer-readable instructions provides further for assigning a high-level message type to each group of the high-level messages having similar data content.

19. The computer-readable storage device of claim 18, where a high-level message that is of a given high-level message type has a corresponding message attribute, and wherein the program of computer-readable instructions provides further for mapping each high-level message to a given high-level message type when the high-level message has a high-level message attribute that is similar to the corresponding message attribute of the given message type.

20. The computer-readable storage device of claim 15, wherein the program of computer-readable instructions provides further for identifying a common message types in high-level transactions, and assigning the identified common sequence of message types as the transaction flow through the network for an associated high-level transaction.