TRANSACTION DISCOVERY IN A LOG SEQUENCE

• US 20180144041A1
• Filed: 11/21/2016
• Published: 05/24/2018
• Est. Priority Date: 11/21/2016
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Chen, Pengfei, Meng, Fan Jing, Xu, Jing Min, YANG, Lin, Zhang, Xiao
• Granted Patent: US 10,740,360 B2
• Time in Patent Office: Days
• CPC Class Codes: G06F 16/24568 Data stream processing; Continuous queries
• CPC Class Codes: G06F 16/285 Clustering or classification
• CPC Class Codes: G06F 9/466 Transaction processing
• CPC Class Codes: H04L 67/10 in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46

Abstract

Techniques that facilitate identification and/or analysis of sequences associated with computing devices are provided. In one example, a system includes a transaction component, a clustering component and a model component. The transaction component identifies at least one sequence in a stream of sequences generated by a computing device in communication with the system. The clustering component assigns the at least one sequence to a transaction sequence group. The model component generates a transaction model based on the transaction sequence group.

Claims

1. A system comprising:

a memory that stores computer executable components;

a processor operably coupled to the memory and that executes computer executable components stored in the memory, wherein the computer executable components comprise;

a transaction component that identifies at least one sequence in a stream of sequences generated by a computing device in communication with the system;

a clustering component that assigns the at least one sequence to a transaction sequence group; and

a model component that generates a transaction model based on the transaction sequence group.

2. The system of claim 1, wherein the at least one sequence is indicative of an operation executed by the computing device, and wherein the transaction component identifies the operation based on the at least one sequence.

3. The system of claim 1, wherein the transaction component identifies the at least one sequence based on a digital signature associated with a portion of the stream of sequences and a filtering criterion associated with the stream of sequences.

4. The system of claim 1, wherein the transaction component identifies the at least one sequence based on timing information or a quality metric associated with the at least one sequence.

5. The system of claim 1, wherein the clustering component assigns the at least one sequence to the transaction sequence group based on a length of the at least one sequence or a total number of digital signatures associated with the at least one sequence.

6. The system of claim 1, wherein the clustering component assigns the at least one sequence to the transaction sequence group based on an interval of time associated with an execution of the at least one sequence via the computing device.

7. The system of claim 1, wherein software is provided as a service in a cloud environment associated with the transaction model.

8. The system of claim 1, wherein the model component determines an abnormality associated with the computing device based on the transaction model, and wherein the transaction model facilitates a decrease in abnormalities associated with the computing device.

9. The system of claim 1, wherein the computer executable components further comprise:

an interleave component that generates the stream of sequences based on unprocessed data received from the computing device.

10. The system of claim 1, wherein the transaction component identifies at least one transaction sequence or at least one log sequence in the stream of sequences generated by the computing device.

11. A computer-implemented method, comprising:

identifying, by a system operatively coupled to a processor, a sequence in a stream of sequences associated with a computing device;

assigning, by the system, the sequence to a transaction sequence group; and

generating, by the system, a transaction model based on the transaction sequence group.

12. The computer-implemented method of claim 11, wherein the identifying comprises identifying the sequence based on timing information associated with a set of digital signatures associated with the stream of sequences.

13. The computer-implemented method of claim 11, wherein the identifying comprises identifying the sequence based on quality data associated with a set of digital signatures associated with the stream of sequences.

14. The computer-implemented method of claim 11, wherein the assigning comprises assigning the sequence to the transaction sequence group based on a length of the sequence.

15. The computer-implemented method of claim 11, wherein the assigning comprises assigning the sequence to the transaction sequence group based on a time period associated with an execution of the sequence by the computing device.

16. The computer-implemented method of claim 11, further comprising:

determining, by the system, whether the computing device satisfies a defined criterion based on the transaction model.

17. The computer-implemented method of claim 11, further comprising:

identifying, by the system, an abnormality associated with the computing device based on the transaction model to facilitate improved performance of the computing device.

18. A computer program product for identifying a transaction sequence, the computer program product comprising a computer readable storage medium having program instructions embodied therewith, the program instructions executable by a processor to cause the processor to:

identify at least one sequence in a stream of sequences associated with a computing device;

assigning the at least one sequence to a transaction sequence group; and

generating a transaction model based on the transaction sequence group.

19. The computer program product of claim 18, wherein the program instructions are further executable by the processor to cause the processor to:

form, based on the at least one sequence, at least a first transaction sequence group for a first transaction model and a second transaction sequence group for a second transaction model.

20. The computer program product of claim 18, wherein the program instructions are further executable by the processor to cause the processor to:

compare the transaction sequence group to another transaction model.