TASK-SPECIFIC APPLICATION MONITORING AND ANALYSIS

• US 20140215495A1
• Filed: 01/27/2014
• Published: 07/31/2014
• Est. Priority Date: 01/25/2013
• Status: Abandoned Application

• Current Assignee: Imprivata Incorporated
• Original Assignee: Imprivata Incorporated
• Inventors: Gage, John, Sengupta, Kuntal, Ting, David M. T., Vernest, Kyle, Erich, Matt, Kelly, Sean, MacLellan, Jeffrey S.
• Application Number:
  US14/164,824
• Publication Number:
  US 20140215495A1
• Time in Patent Office: Days
• US Class Current: 719/318
• CPC Class Codes: G06F 11/3082 the data filtering being achieved by aggregating or compressing the monitored data
• CPC Class Codes: G06F 11/3093 Configuration details thereof, e.g. installation, enabling, spatial arrangement of the probes
• CPC Class Codes: G06F 11/3438 monitoring of user actions tracking the activity of the user H04L67/535
• CPC Class Codes: G06F 11/3476 Data logging G06F11/14, G06F11/2205 take precedence
• CPC Class Codes: G06F 2201/86 Event-based monitoring
• CPC Class Codes: G06F 2201/865 Monitoring of software
• CPC Class Codes: G06F 2209/545 Gui

Abstract

User interactions with multiple applications executed on a computational device may be monitored by intercepting messages corresponding to application-level events and recording data associated with the events, including, e.g., contents of application screens presented when the events occurred. The screen contents may be used, based on comparison with task-specific screen-sequence patterns, to link sub-sequences of the events to tasks, facilitating subsequent task-related analysis.

Claims

1. A computer-implemented method for monitoring usage of one or more user applications executed as one or more running processes on a computational device, the method comprising:

intercepting messages of the one or more user applications corresponding to a sequence of events;

recording data associated with the events, including contents of application screens presented when the events occurred; and

inferring one or more tasks associated with one or more respective subsequences of the events based, at least in part, from corresponding sequences of application screens.

2. The method of claim 1, further comprising filtering the recorded data based at least in part on the identified one or more tasks.

3. The method of claim 2, wherein filtering the recoded data comprises retaining only data associated with events of the one or more subsequences.

4. The method of claim 2, wherein filtering the recorded data comprises receiving an indication of one or more types of data relevant to the identified one or more tasks and retaining, for each event of the one or more subsequences, only data of the relevant types.

5. The method of claim 1, further comprising computing a metric for at least one identified tasks based at least in part on the data associated therewith.

6. The method of claim 5, wherein the metric comprises at least one of a time elapsed from start to completion of performance of the task, a number of screens accessed during performance of the task, a number of screen transitions associated with performance of the task, or a number of different applications accessed during performance of the task.

7. The method of claim 1, wherein inferring the one or more tasks comprises comparing a sequence of application screens associated with the sequence of events against a database of task-specific screen-sequence patterns.

8. The method of claim 7, further comprising recognizing, for each of the events of the sequence of events, an application screen associated therewith based on the recorded application screen contents.

9. The method of claim 8, wherein recognizing the application screens comprises comparing the screen contents recorded for each of the events against a database of reference screens.

10. The method of claim 1, further comprising filtering the recorded data, prior to inferring the one or more tasks, based at least in part on the application screen contents.

12. The method of claim 1, wherein at least one of the one or more subsequences comprises events associated with a plurality of user applications.

13. The method of claim 1, wherein intercepting messages corresponding to a sequence of events and recording data associated with the events comprises hooking into the message queues of the one or more applications and saving the data in respective memory queues.

14. The method of claim 1, further comprising aggregating the data across multiple applications by asynchronously reading out the memory queues of the multiple applications and storing the data contained therein in a journal file.

15. The method of claim 1, further comprising aggregating the data across multiple computational devices by uploading journal files therefrom to a central server.

11. The method of claim 11, wherein filtering the recorded data comprises comparing the application screen contents against a database of screen elements associated with tasks of interest.

16. A system for monitoring usage of one or more user applications, the system comprising:

a computational device comprising

a. a display;

b. an active computer memory; and

c. a processor configured to execute (i) the one or more user applications stored in the active computer memory and (ii) an agent application, wherein execution of the agent application by the processor causes the processor to;

i. intercept messages generated by execution of the user application and corresponding to a sequence of events;

ii. recording data associated with the events, including contents of application screens presented on the display when the events occurred, in the memory; and

iii. inferring one or more tasks associated with one or more respective subsequences of the events based, at least in part, from corresponding sequences of application screens.

17. The system of claim 16, further comprising a database of reference screens, wherein execution of the agent application causes the processor to compare the stored contents of application screens against the reference screens to thereby identify the screens.

18. The system of claim 17, further comprising a database of task-specific screen-sequence patterns, wherein execution of the agent application causes the processor to compare sequences of application screens, following identification thereof, against the task-specific screen-sequence patterns to thereby infer the one or more tasks associated with the sequences of application screens.

19. The system of claim 18, wherein at least one of the database of reference screens and the database of task-specific screen-sequence patterns is stored on a reference server in communication with the computational device.

20. The system of claim 16, further comprising a computational analysis facility configured to compute a metric for at least one identified tasks based at least in part on the data associated therewith.

21. The system of claim 20, wherein the analysis facility comprises a server in communication with the computational device, the server comprising a processor and computer memory, the memory storing instructions which, when executed by the processor, cause the processor to compute the metric.

22. The system of claim 21, wherein the metric comprises at least one of a time elapsed from start to completion of performance of the task, a number of screens accessed during performance of the task, a number of screen transitions associated with performance of the task, or a number of different applications accessed during performance of the task.

23. The system of claim 16, wherein execution of the agent application by the processor causes the processor further to filter the recorded data based at least in part on the identified one or more tasks.

24. The method of claim 16, wherein at least one of the one or more subsequences comprises events associated with a plurality of user applications.

25. The method of claim 16, wherein execution of the agent application causes the processor to intercept the messages corresponding to the events by hooking into the message queues of the one or more applications and saving the data associated with the events in respective memory queues.

26. The method of claim 25, wherein execution of the agent application further causes the processor to aggregate the data across multiple applications by asynchronously reading out the memory queues of the multiple applications and storing the data contained therein in a journal file in the memory.

27. The method of claim 26, further comprising a central server, wherein execution of the agent application further causes the processor to upload the journal file to the central server for aggregation of data across computational devices thereat.