System and method for analyzing remote traffic data in distributed computing environment

• US 6,360,261 B1
• Filed: 10/21/1999
• Issued: 03/19/2002
• Est. Priority Date: 02/14/1997
• Status: Expired due to Term

• Current Assignee: Oracle International Corporation (Oracle Corporation)
• Original Assignee: WebTrends Incorporated (WebTrends Holding, Inc.)
• Inventors: Shapira, Elijahu, Boyd, William Glen
• Primary Examiner(s): Coulter, Kenneth R.
• Application Number:
  US09/425,280
• Time in Patent Office: 880 Days
• Field of Search: 709/224, 709/218, 709/223
• US Class Current: 709/224
• CPC Class Codes: H04L 43/00 Arrangements for monitoring or testing data switching networks
• CPC Class Codes: H04L 43/045 for graphical visualisation of monitoring data
• CPC Class Codes: H04L 43/06 Generation of reports
• CPC Class Codes: H04L 43/062 related to network traffic
• CPC Class Codes: H04L 43/14 using software, i.e. software packages network security related monitoring H04L63/1408
• CPC Class Codes: H04L 43/18 Protocol analysers
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]
• CPC Class Codes: H04L 67/125 involving control of end-device applications over a network
• CPC Class Codes: H04L 67/535 Tracking the activity of the user network monitoring arrangements H04L43/00; recording of computer activity G06F11/34
• CPC Class Codes: H04L 67/75 Indicating network or usage conditions on the user display

Abstract

A system, method and storage medium embodying computer-readable code for analyzing traffic data in a distributed computing environment are described. The distributed computing environment includes a plurality of interconnected systems operatively coupled to a server, a source of traffic data hits and one or more results tables categorized by an associated data type. Each results table includes a plurality of records. The server is configured to exchange data packets with each interconnected system. Each traffic data hit corresponds to a data packet exchanged between the server and one such interconnected system. Each traffic data hit is collected from the traffic data hits source as access information into one such record is in at least one results table according to the data type associated with the one such results table. Each of the records in the results table corresponds to a different type of access information for the data type associated with the results table. The access information collected into the results tables during a time slice is summarized periodically into analysis results. The time slice corresponds to a discrete reporting period. The access information is analyzed from the results tables in the analysis results to form analysis summaries according to the data types associated with the results tables.

Claims

1. A method for analyzing traffic data in a distributed computing environment that includes a plurality of interconnected systems operatively coupled to a server, said method comprising:

generating a plurality of traffic data hits, each of said hits corresponding to data exchanged between one of the servers and one of the interconnected systems;

storing access information from the traffic data hits in one or more results tables;

defining a time slice;

storing the results tables as analysis results for each reoccurrence of the time slice;

defining a time frame of interest that is longer than the time slice;

generating an analysis summary from a plurality of analysis results;

providing a user session table comprising one or more records that each store a pointer and one or more microtables, each pointer corresponding to one of the results tables, each of the microtables including one or more indices and being associated with one of the results tables, each such index within the microtable logically referring to access information collected in an associated results table, each such pointer in the user session table further logically referring to one of the microtables, the method further comprising;

counting a user session for each associated results table; and

adjusting the user session count for consecutive time slices.

2. The method of claim 1 wherein the distributed computing environment further comprises a container file comprising a table of contents and configured to store the one or more results tables, the user sessions table and the one or more microtables, the method further comprising:

mapping relative positions of each results table within the container file into the table of contents; and

storing each pointer in the user session table with the relative positions of each microtable within the container file.

3. A system for analyzing traffic data in a distributed computing environment, the distributed computing environment comprising a plurality of interconnected systems operatively coupled to a server that is configured to exchange data with each interconnected system, comprising:

a source of traffic data hits, each traffic data hit corresponding to data exchanged between the server and one such interconnected system;

one or more results tables;

a plurality of records stored in each results table;

means for collecting access information from each traffic data hit;

means for storing the access information into one of said records in one of the results tables;

means for periodically summarizing the access information stored in the results tables into analysis results, said access information being summarized once for each reoccurrence of a time slice;

means for analyzing the access information from the results tables in the analysis results to form analysis summaries;

a user session table comprising one or more records which each store a pointer, each pointer corresponding to one of the results tables, the collecting means including a user session count for each such results table, the user session count being stored in the user session table in each of the records; and

one or more microtables, each of the microtables including one or more indices and being associated with one of the results tables, each such index within the microtable logically referring to access information collected in an associated results table, each such pointer in the user session table further logically referring to one of the microtables, the analyzing means further comprising means for adjusting the user session count for consecutive time slices.

4. A system according to claim 3, further comprising:

a container file comprising a table of contents and configured to store the one or more results tables, the user sessions table and the one or more microtables, the summarizing means further comprising means for mapping relative positions of each such results table within the container file into the table of contents and storing each such pointer in the user session table with the relative positions of each such microtable within the container file.

5. A method for analyzing traffic data in a distributed computing environment that includes a plurality of interconnected systems operatively coupled to a server, said method comprising:

generating a plurality of traffic data hits including access information, each of said hits corresponding to data exchanged between one of the servers and one of the interconnected systems;

storing access information from the traffic data hits in one or more results tables;

defining a time slice;

storing the results tables as analysis results for each reoccurrence of the time slice;

defining a time frame of interest that is longer than the time slice;

generating an analysis summary from a plurality of analysis results;

summarizing the access information for each time slice occurring within a time frame for which analysis summaries are not available but access information from analysis results is available;

storing the summarized access information formed in the preceding step as analysis summaries;

summarizing the access information for each time slice occurring within the time frame for which analysis results are not available but access information from a results table is available;

storing the summarized access information formed in the preceding step as analysis results; and

creating analysis summaries from the analysis results formed in the preceding step.

6. A method for analyzing traffic data in a distributed computing environment that includes a plurality of interconnected systems operatively coupled to a server, said method comprising:

collecting a plurality of traffic data hits that each corresponds to data exchanged between said server and one of the interconnected systems;

storing summarized access information in at least one table;

defining a time slice;

storing data extracted from said table for each reoccurrence of the time slice;

defining a time frame of interest that is shorter than the time slice;

using the stored data to generate a report that corresponds to the time frame of interest;

summarizing access information in said one table, wherein storing data extracted from said table comprises storing the summarized access information;

storing the summarized access information in a series of sequential storage units that each corresponds to the time slice associated with the summarized access information; and

summarizing access information corresponding to the time frame of interest in at least one of the sequential storage units.

7. A method for analyzing traffic data in a distributed computing environment that includes a plurality of interconnected systems operatively coupled to a server, said method comprising:

collecting a plurality of traffic data hits that each corresponds to data exchanged between said server and one of the interconnected systems;

storing summarized access information in at least one table;

defining a time slice;

storing data extracted from said table for each reoccurrence of the time slice;

defining a time frame of interest that is longer than the time slice;

using the stored data to generate a report that corresponds to the time frame of interest;

summarizing access information in said one table, wherein storing data extracted from said table comprises storing the summarized access information;

storing the summarized access information in a series of sequential storage units that each corresponds to the time slice associated with the summarized access information; and

summarizing access information corresponding to the time frame of interest in at least two of the sequential storage units.

8. A method for analyzing traffic data in a distributed computing environment that includes a plurality of interconnected systems operatively coupled to a server, said method comprising:

collecting a plurality of traffic data hits that each corresponds to data exchanged between said server and one of the interconnected systems;

storing summarized access information in at least one table;

defining a time slice;

storing data extracted from said table for each reoccurrence of the time slice;

defining a time frame of interest;

using the stored data to generate a report that corresponds to the time frame of interest;

summarizing access information in said one table, wherein storing data extracted from said table comprises storing the summarized access information;

storing the summarized access information in a series of sequential storage units that each corresponds to the time slice associated with the summarized access information, said time frame of interest including at least one of the sequential storage units and at least a portion of said one table; and

summarizing access information corresponding to the time frame of interest in said one sequential storage unit and said one table.