Application instrumentation and monitoring

• US 7,496,575 B2
• Filed: 11/22/2004
• Issued: 02/24/2009
• Est. Priority Date: 11/22/2004
• Status: Active Grant

• Current Assignee: Digital Guardian LLC
• Original Assignee: Verdasys Incorporated
• Inventors: Carson, Dwayne, Fernandes, Luis M., Halio, Leonard F., Birnbaum, Seth N., Buccella, Donato, Stamos, Nicholas
• Primary Examiner(s): Vy; Hung T
• Application Number:
  US10/995,020
• Publication Number:
  US 20060123101A1
• Time in Patent Office: 1,555 Days
• Field of Search: 709/224, 709/203, 707/102, 707/10, 707/9, 717/128, 717/127, 713/165, 713/188
• US Class Current: 1/1
• CPC Class Codes: G06F 21/552 involving long-term monitoring or reporting
• CPC Class Codes: G06F 21/554 involving event detection and direct action
• CPC Class Codes: G06F 21/6245 Protecting personal data, e.g. for financial or medical purposes
• CPC Class Codes: G06F 2221/2101 Auditing as a secondary aspect

Abstract

A data processing application logging, recording, and reporting process and infrastructure. Compliance with regulatory directives such as HIPAA, internal organizational and corporate, personal information privacy, and other security policies can thus be enforced without the need to recode legacy application software. In one preferred embodiment, a core agent process provides “listener” functionality that captures user input events, such as keyboard and mouse interactions, between a user and a legacy application of interest. The agent obtains instructions for how to deal with such events, accessing information that describes the application'"'"'s behavior as already captured by an application profiler tool. Keyboard and mouse data entry sequences, screen controls and fields of interest are tagged during application profiling process. This data is stored in application profile developed for each mode of a legacy application. The technique can be implemented in various Information Technology (IT) environments including mainframe/terminal applications and/or client/server applications. Thus, full coverage of “fat” client, “thin” client, and legacy “mainframe” applications can be provided with a common approach across an enterprise.

Claims

1. A method for controlling activity in an application process comprising:

running a profiler process as an autonomous process that is separate from the application process, the profiler process further performing the steps of;

capturing sets of low-level events with respect to operation of the application profile, the low-level events being performed by an administrative user and corresponding to application-level activities associated with the application process; and

generating application profiles representing the correspondences of the sets of low-level events to the application-level activities; and

running an agent process as an autonomous process that is separate from the application process, the agent process further performing the steps of;

detecting a set of predetermined low-level events related to operation of the application process by a user;

identifying at least one application profile that represents a correspondence of the set of detected low-level user events to an application- level activity associated with the application process; and

controlling further permitted application-level activities, according to one or more rules associated with the application profile that corresponds to the detected set of low-level events, without modifying program logic of the application process.

2. A method as in claim 1 additionally comprising:

logging such monitored activity of the application by recording an identifier of the application-level activity.

3. A method as in claim 1 wherein the application profile is stored in a higher level mark-up language.

4. A method as in claim 1 wherein the application process runs in a client/server data processing system.

5. A method as in claim 4 wherein the agent process runs as a kernel process in an operating system within the client.

6. A method as in claim 1 wherein the application process runs in a mainframe/terminal data processing system.

7. A method as in claim 6 wherein the agent process monitors data communications between the mainframe and the terminal.

8. A method as in claim 1 wherein the application process runs in a mainframe emulator/terminal server data processing system.

9. A method as in claim 1 wherein the agent process identifies rules that ensure compliance with specified application data access restrictions.

10. A method as in claim 1 wherein the rules are specified depending upon a class of user of the application process.

11. A method as in claim 1 wherein a profile server stores multiple application profiles;

and

the agent process further comprises steps for receiving one or more application profiles from the profile server.

12. A method as in claim 1 wherein the predetermined low-level user events are selected from a group consisting of input field data entry, key strokes, menu selections, and button clicks.

13. A method as in claim 1 wherein the predetermined application-level actions are selected from a group consisting of adding, modifying, or deleting a data record.

14. A method as in claim 1 wherein the predetermined application-level actions are user logins.

15. An apparatus for monitoring activity of an application comprising:

one or more data processors for running a profiler process and an agent process as autonomous processes that are separate from the application process, the profiler process capturing sets of low-level events with respect to input to the application by an administrative user and generating application profiles representing correspondences of the sets of low-level events to application-level actions associated with the application process; and

the agent process further comprising;

a detector, for detecting one or more predetermined low-level events related to user input to the application; and

a comparator, for comparing the detected low-level events against one or more patterns of such low-level events to determine if an application-level action has occurred, a representation of such patterns of low-level events and corresponding application-level actions and rules provided in an application profile;

whereby monitoring application-level actions is thus possible without modifying program logic of the application.

16. An apparatus as in claim 15 additionally wherein the agent process further controls at least one subsequent application-level action according to one or more rules associated with the application-level action.

17. An apparatus as in claim 16 wherein the rules specify compliance with application data access restrictions.

18. An apparatus as in claim 16 wherein the rules are specified depending upon a class of user of the application.

19. An apparatus as in claim 15 additionally comprising:

a data logger, for logging such application-level actions thereby detected.

20. An apparatus as in claim 15 wherein the application runs in a client/server data processing system.

21. An apparatus as in claim 20 wherein the agent runs as a kernel process in an operating system within the client.

22. An apparatus as in claim 15 wherein the application runs in a mainframe/terminal data processing system.

23. An apparatus as in claim 22 wherein the agent process monitors communications between the mainframe and the terminal.

24. An apparatus as in claim 15 wherein the application runs in a mainframe emulator/terminal server data processing system.

25. An apparatus as in claim 15 additionally wherein:

a profile server stores application profiles; and

the agent receives one or more application profiles from the profile server.

26. An apparatus as in claim 15 wherein the predetermined low-level events are selected from a group consisting of input field data entry, key strokes, menu selections, and button clicks.

27. An apparatus as in claim 15 wherein the predetermined application-level events are selected from a group consisting of data added, data modified, and data deleted.

28. An apparatus as in claim 15 wherein the predetermined application-level actions are user logins.

29. An apparatus as in claim 25 wherein some of the applications run in a client/server environment and other applications run in a mainframe/terminal environment, each application accessing a common application template server.