System and method for analyzing remote traffic data in a distributed computing environment

• US 6,662,227 B2
• Filed: 01/11/2002
• Issued: 12/09/2003
• Est. Priority Date: 02/14/1997
• Status: Expired due to Term

• Current Assignee: Oracle International Corporation (Oracle Corporation)
• Original Assignee: NetIQ Corporation (Open Text Corporation)
• Inventors: Shapira, Elijahu, Boyd, William Glen
• Primary Examiner(s): Coulter, Kenneth R.
• Application Number:
  US10/046,976
• Publication Number:
  US 20020091823A1
• Time in Patent Office: 697 Days
• Field of Search: 709/224, 709/223, 709/218, 709/203, 707/1, 707/10, 707/100
• US Class Current: 709/224
• CPC Class Codes: H04L 43/00 Arrangements for monitoring or testing data switching networks
• CPC Class Codes: H04L 43/045 for graphical visualisation of monitoring data
• CPC Class Codes: H04L 43/06 Generation of reports
• CPC Class Codes: H04L 43/062 related to network traffic
• CPC Class Codes: H04L 43/14 using software, i.e. software packages network security related monitoring H04L63/1408
• CPC Class Codes: H04L 43/18 Protocol analysers
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]
• CPC Class Codes: H04L 67/125 involving control of end-device applications over a network
• CPC Class Codes: H04L 67/535 Tracking the activity of the user network monitoring arrangements H04L43/00; recording of computer activity G06F11/34
• CPC Class Codes: H04L 67/75 Indicating network or usage conditions on the user display

Abstract

A system, method and storage medium embodying computer-readable code for analyzing traffic data in a distributed computing environment are described. The distributed computing environment includes a plurality of interconnected systems operatively coupled to a server, a source of traffic data hits and one or more results tables categorized by an associated data type. Each results table includes a plurality of records. The server is configured to exchange data packets with each interconnected system. Each traffic data hit corresponds to a data packet exchanged between the server and one such interconnected system. Each traffic data hit is collected from the traffic data hits source as access information into one such record in at least one results table according to the data type associated with the one such results table. Each of the records in the results table corresponds to a different type of access information for the data type associated with the results table. The access information collected into the results tables during a time slice is summarized periodically into analysis results. The time slice corresponds to a discrete reporting period. The access information is analyzed from the results tables in the analysis results to form analysis summaries according to the data types associated with the results tables.

Claims

1. A system for analyzing traffic data in a distributed computing environment, the distributed computing environment comprising a plurality of interconnected systems operatively coupled to a server, the server configured to exchange data packets with each interconnected system, comprising:

a source of traffic data hits, each traffic data hit corresponding to a data packet exchanged between the server and one such interconnected system;

one or more results tables categorized by an associated data type, each results table comprising a plurality of records;

means for collecting each traffic data hit from the traffic data hits source as access information into one such record in at least one results table according to the data type associated with the one such results table, each of the records in the results table corresponding to a different type of access information for the data type associated with the results table;

means for summarizing periodically the access information collected into the results tables during a time slice into analysis results, the time slice corresponding to a discrete reporting period; and

means for analyzing the access information from the results tables in the analysis results to form analysis summaries according to the data types associated with the results tables.

2. A system according to claim 1, wherein each such interconnected system interfaces to the server via one of a network connection, a point-to-point connection and a dedicated connection.

3. A system according to claim 1, wherein the server further comprises a log file operatively coupled to the server and storing the traffic data hits, the log file operating as the source of traffic data hits responsive to the collecting means.

4. A system according to claim 1, wherein the server further comprises a database operatively coupled to the server and storing at least one of the traffic data hits and the analysis results, the database operating as the source of traffic data hits responsive to the collecting means.

5. A system according to claim 1, further comprising:

a user session table comprising one or more records which each store a pointer, each pointer corresponding to one of the results tables, the collecting means including a user session count for each such data type associated with each such results table, the user session count being stored in the user session table in each of the records; and

one or more microtables, each of the microtables including one or more indices and being associated with one of the results tables, each such index within the microtable logically referring to each such different type of access information collected in the associated results table, each such pointer in the user session table further logically referring to one of the microtables, the analyzing means further comprising means for adjusting the user session count for consecutive time slices.

6. A system according to claim 5, further comprising:

a container file comprising a table of contents and configured to store the one or more results tables, the user sessions table and the one or more microtables, the summarizing means further comprising means for mapping relative positions of each such results table within the container file into the table of contents and storing each such pointer in the user session table with the relative positions of each such microtable within the container file.

29. The method of claim 2l in which summarizing collected access information comprises summarizing the collected access information by type.

7. A method for analyzing traffic data in a distributed computing environment, the distributed computing environment comprising a plurality of interconnected systems operatively coupled to a server, a source of traffic data hits and one or more results tables categorized by an associated data type, each results table comprising a plurality of records, the server configured to exchange data packets with each interconnected system, each traffic data hit corresponding to a data packet exchanged between the server and one such interconnected system, the method comprising the steps of:

collecting each traffic data hit from the traffic data hits source as access information into one such record in at least one results table according to the data type associated with the one such results table, each of the records in the results table corresponding to a different type of access information for the data type associated with the results table;

summarizing periodically the access information collected into the results tables during a time slice into analysis results, the time slice corresponding to a discrete reporting period; and

analyzing the access information from the results tables in the analysis results to form analysis summaries according to the data types associated with the results tables.

8. A method according to claim 7, further comprising the step of interfacing each such interconnected system to the server via one of a network connection, a point-to-point connection and a dedicated connection.

9. A method according to claim 7, further comprising the steps of:

operatively coupling the server to a log file; and

storing the traffic data hits from the traffic data hits source into the log file, the log file operating as the source of traffic data hits in the step of collecting each traffic data hit.

10. A method according to claim 7, further comprising the steps of:

operatively coupling the server to a database; and

storing at least one of the traffic data hits from the traffic hits source and the analysis results into the log file, the database operating as the source of traffic data hits in the step of collecting each traffic data hit.

11. A method according to claim 7, wherein the distributed computing environment further comprises a user session table comprising one or more records which each store a pointer and one or more microtables, each pointer corresponding to one of the results tables, each of the microtables including one or more indices and being associated with one of the results tables, each such index within the microtable logically referring to each such different type of access information collected in the associated results table, each such pointer in the user session table further logically referring to one of the microtables, the method further comprising the steps of:

counting a user session for each such data type associated with each such results table;

storing the user session count stored in the user session table in each of the records; and

adjusting the user session count for consecutive time slices.

12. A method according to claim 11, the distributed computing environment further comprising a container file comprising a table of contents and configured to store the one or more results tables, the user sessions table and the one or more microtables, the method further comprising the steps of:

mapping relative positions of each such results table within the container file into the table of contents; and

storing each such pointer in the user session table with the relative positions of each such microtable within the container file.

13. A method according to claim 7, the step of analyzing the access information further comprising the steps of:

defining a time frame comprising a discrete period of time; and

analyzing the analysis results for each such time slice occurring within the time frame based on availability of access information in the analysis results.

14. A method according to claim 13, the step of analyzing the analysis results comprising one pass and further comprising the steps of:

summarizing the access information available as analysis summaries in the analysis results;

performing the step of summarizing periodically the access information for each such time slice occurring within the time frame whereby analysis summaries are not available but access information from the results table is available in the analysis results;

summarizing the analysis summaries formed in the preceding step;

performing the steps of collecting each traffic data hit and summarizing periodically the access information for each such time slice occurring in the time frame whereby analysis summaries and access information from the results table are not available in the analysis results; and

summarizing the analysis summaries formed in the preceding step.

15. A method according to claim 13, the step of analyzing the analysis results comprising two passes and further comprising the steps of:

performing the step of summarizing periodically the access information for each such time slice occurring within the time frame whereby analysis summaries are not available but access information from the results table is available in the analysis results;

performing the steps of collecting each traffic data hit and summarizing periodically the access information for each such time slice occurring in the time frame whereby analysis summaries and access information from the results table are not available in the analysis results; and

summarizing the access information available as analysis summaries in the analysis results.

16. A storage medium embodying computer-readable code for analyzing traffic data in a distributed computing environment, the distributed computing environment comprising a plurality of interconnected systems operatively coupled to a server, a source of traffic data hits and one or more results tables categorized by an associated data type, each results table comprising a plurality of records, the server configured to exchange data packets with each interconnected system, each traffic data hit corresponding to a data packet exchanged between the server and one such interconnected system, comprising:

means for collecting each traffic data hit from the traffic data hits source as access information into one such record in at least one results table according to the data type associated with the one such results table, each of the records in the results table corresponding to a different type of access information for the data type associated with the results table;

means for summarizing periodically the access information collected into the results tables during a time slice into analysis results, the time slice corresponding to a discrete reporting period; and

means for analyzing the access information from the results tables in the analysis results to form analysis summaries according to the data types associated with the results tables.

17. A storage medium according to claim 16, wherein the distributed computing environment further comprises a user session table comprising one or more records which each store a pointer and one or more microtables, each pointer corresponding to one of the results tables, each of the microtables including one or more indices and being associated with one of the results tables, each such index within the microtable logically referring to each such different type of access information collected in the associated results table, each such pointer in the user session table further logically referring to one of the microtables, further comprising:

means for counting a user session for each such data type associated with each such results table;

means for storing the user session count stored in the user session table in each of the records; and

means for adjusting the user session count for consecutive time slices.

18. A storage medium according to claim 16, the means for analyzing the access information further comprising:

means for defining a time frame comprising a discrete period of time; and

means for analyzing the analysis results for each such time slice occurring within the time frame based on availability of access information in the analysis results.

19. A storage medium according to claim 16, the means for analyzing the analysis results comprising one pass and further comprising:

means for summarizing the access information available as analysis summaries in the analysis results;

means for performing the step of summarizing periodically the access information for each such time slice occurring within the time frame whereby analysis summaries are not available but access information from the results table is available in the analysis results;

means for summarizing the analysis summaries formed in the preceding step;

means for performing the steps of collecting each traffic data hit and summarizing periodically the access information for each such time slice occurring in the time frame whereby analysis summaries and access information from the results table are not available in the analysis results; and

means for summarizing the analysis summaries formed in the preceding step.

20. A storage medium according to claim 16, the means for analyzing the analysis results comprising two passes and further comprising:

means for performing the step of summarizing periodically the access information for each such time slice occurring within the time frame whereby analysis summaries are not available but access information from the results table is available in the analysis results;

means for performing the steps of collecting each traffic data hit and summarizing periodically the access information for each such time slice occurring in the time frame whereby analysis summaries and access information from the results table are not available in the analysis results; and

means for summarizing the access information available as analysis summaries in the analysis results.

21. A method for analyzing access information in a distributed computing environment, the method comprising:

creating a container file;

inventorying the container file;

collecting a plurality of traffic data hits including access information;

summarizing the collected access information;

creating analysis results from the collected access information;

storing the analysis results in the container file;

defining a predetermined time frame; and

generating analysis results for the predetermined time frame.

22. The method of claim 21 in which collecting traffic data hits comprises collecting the traffic data hits from a single traffic source.

23. The method of claim 21 in which collecting traffic data hits comprises collecting the traffic data hits from a plurality of sources.

24. The method of claim 21, further comprising creating analysis summaries from one or more analysis results.

25. The method of claim 24, further comprising inventorying available analysis summaries stored in the container file.

26. The method of claim 21, further comprising dividing the predetermined time frame into smaller time frames and storing analysis results of at least one of the smaller time frames.

27. The method of claim 26, further comprising generating analysis results for the at least one of the smaller time frames.

28. The method of claim 21, further comprising adjusting the analysis summaries where access information is counted more than once.

30. The method of claim 21 in which summarizing collected access information comprises summarizing the collected access information for on-demand analysis.

31. The method of claim 21 in which creating the container file comprises creating one or more results tables differentiated by one or more data types.

32. The method of claim 31 in which creating one or more results tables further comprises creating records in the one or more results tables.