WEB TRANSACTION ANALYSIS

• US 20110145715A1
• Filed: 12/08/2010
• Published: 06/16/2011
• Est. Priority Date: 12/10/2009
• Status: Active Grant

• Current Assignee: Riverbed Technology, LLC (Riverbed Technology Incorporated)
• Original Assignee: Riverbed Technology Incorporated
• Inventors: MALLOY, Patrick J., Martin, Seth, Chernyakov, Alex, Plun, Jerome
• Granted Patent: US 8,635,334 B2
• Time in Patent Office: Days
• US Class Current: 715/738
• CPC Class Codes: G06F 11/3409 for performance assessment
• CPC Class Codes: G06F 11/3466 Performance evaluation by tracing or monitoring
• CPC Class Codes: G06F 2201/87 Monitoring of transactions
• CPC Class Codes: G06F 2201/875 Monitoring of systems including the internet
• CPC Class Codes: H04L 43/026 using flow identification
• CPC Class Codes: H04L 43/04 Processing captured monitoring data, e.g. for logfile generation
• CPC Class Codes: H04L 43/045 for graphical visualisation of monitoring data
• CPC Class Codes: H04L 43/0888 Throughput

Abstract

Individual network activities are correlated to interactions with a target web page to facilitate an analysis of the performance of the web page. This correlation is preferably performed using a combination of heuristics and rules developed to filter network activities into those activities that are likely to have been caused by the particular transaction, and those that are unlikely to be associated with that transaction. The activities that are identified as being associated with the transaction are subsequently organized to identify a time-flow of these activities within the transaction, from which performance statistics can be determined and presented to a user. Because the individual activities within the transaction are identified and time-ordered, an analysis of the effects of each activity on the overall performance of the web page can be performed to identify potential problem areas, or to diagnose reported problems.

Claims

1. A method comprising:

collecting a plurality of traffic streams,

parsing each traffic stream into a plurality of HTTP objects,

identifying a page object in the plurality of HTTP objects,

identifying one or more page elements in the plurality of HTTP objects that are associated with the page object,

determining performance parameters associated with the page object based on characteristics of the one or more page elements, and

providing a display based on the performance parameters;

wherein identifying the one or more page elements includes assessing the plurality of HTTP objects based on a set of heuristics.

2. The method of claim 1, wherein at least one heuristic is based on an HTTP referrer field in the HTTP object.

3. The method of claim 1, wherein at least one heuristic is based on an HTTP location field in the HTTP object.

4. The method of claim 1, wherein at least one heuristic is based on a time associated with the HTTP object.

5. The method of claim 1, wherein at least one heuristic is based on an HTTP user agent field in the HTTP object.

6. The method of claim 1, wherein at least one heuristic is based on one or more address fields associated with the HTTP object.

7. The method of claim 1, wherein at least one heuristic is based on one or more cookies in the HTTP object.

8. The method of claim 1, wherein identifying the page object is based on a content type in the HTTP object.

9. The method of claim 1, wherein identifying the one or more page elements includes using one or more decision trees that control a sequence of assessments based on the set of heuristics.

10. The method of claim 9, including detecting an anomaly in the traffic streams and modifying the decision tree based on the anomaly.

11. The method of claim 9, wherein each heuristic includes a priority and the decision tree is structured based on the priorities of the heuristics.

12. The method of claim 11, including detecting an anomaly in the traffic streams and modifying the priorities based on the anomaly.

13. The method of claim 1, wherein the parsing of one or more of the traffic streams includes decrypting content of the traffic stream, and the presenting of the display in includes preventing display of some or all of the decrypted content.

14. A system comprising:

one or more network monitors that is configured to capture a plurality of traffic streams,

a transaction identifier that is configured to;

parse each traffic stream into a plurality of HTTP objects, and

identify a page object in the plurality of HTTP objects,

a page stitcher that is configured to identify one or more page elements in the plurality of HTTP objects that are associated with the page object,

a performance analyzer that is configured to determine performance parameters associated with the page object based on characteristics of the one or more page elements, and

a user interface that is configured to provide a display based on the performance parameters;

wherein identifying the one or more page elements includes assessing the plurality of HTTP objects based on a set of heuristics.

15. The system of claim 14, wherein at least one heuristic is based on an HTTP referrer field in the HTTP object.

16. The system of claim 14, wherein at least one heuristic is based on an HTTP location field in the HTTP object.

17. The system of claim 14, wherein at least one heuristic is based on a time associated with the HTTP object.

18. The system of claim 14, wherein at least one heuristic is based on an HTTP user agent field in the HTTP object.

19. The system of claim 14, wherein at least one heuristic is based on one or more address fields associated with the HTTP object.

20. The system of claim 14, wherein at least one heuristic is based on one or more cookies in the HTTP object.

21. The system of claim 14, wherein identifying the page object is based on a content type in the HTTP object.

22. The system of claim 14, wherein identifying the one or more page elements includes using one or more decision trees that control a sequence of assessments based on the set of heuristics.

23. The system of claim 22, wherein the page stitcher is configured to detect an anomaly in the traffic streams and modifying the decision tree based on the anomaly.

24. The system of claim 22, wherein each heuristic includes a priority and the decision tree is structured based on the priorities of the heuristics.

25. The system of claim 24, including detecting an anomaly in the traffic streams and modifying the priorities based on the anomaly.

26. The system of claim 14, wherein the parsing of one or more of the traffic streams includes decrypting content of the traffic stream, and the presenting of the display in includes preventing display of some or all of the decrypted content.

27. A non-transitory computer-readable medium that includes a program that, when executed by a processor, causes the processor to:

;

capture a plurality of traffic streams,

parse each traffic stream into a plurality of HTTP objects, and

identify a page object in the plurality of HTTP objects,

identify one or more page elements in the plurality of HTTP objects that are associated with the page object,

determine performance parameters associated with the page object based on characteristics of the one or more page elements, and

provide a display based on the performance parameters;

wherein the program causes the processor to identify the one or more page elements by assessing the plurality of HTTP objects based on a set of heuristics.

28. The medium of claim 27, wherein at least one heuristic is based on an HTTP referrer field in the HTTP object.

29. The medium of claim 27, wherein at least one heuristic is based on an HTTP location field in the HTTP object.

30. The medium of claim 27, wherein at least one heuristic is based on a time associated with the HTTP object.

31. The medium of claim 27, wherein at least one heuristic is based on an HTTP user agent field in the HTTP object.

32. The medium of claim 27, wherein at least one heuristic is based on one or more address fields associated with the HTTP object.

33. The medium of claim 27, wherein at least one heuristic is based on one or more cookies in the HTTP object.

34. The medium of claim 27, wherein identifying the page object is based on a content type in the HTTP object.

35. The medium of claim 27, wherein the program causes the processor to identify the one or more page elements by using one or more decision trees that control a sequence of assessments based on the set of heuristics.

36. The medium of claim 35, wherein the program enables the processor to detect an anomaly in the traffic streams and modify the decision tree based on the anomaly.

37. The medium of claim 35, wherein each heuristic includes a priority and the decision tree is structured based on the priorities of the heuristics.

38. The medium of claim 37, wherein the program enables the processor to identify anomaly in the traffic streams and modify the priorities based on the anomaly.

39. The medium of claim 27, wherein the program causes the processor to parse one or more of the traffic streams by decrypting content of the traffic stream, and prevent display of some or all of the decrypted content.