Real-time performance assessment of large area network user experience

• US 7,523,190 B1
• Filed: 12/23/1999
• Issued: 04/21/2009
• Est. Priority Date: 12/23/1999
• Status: Expired due to Fees

• Current Assignee: Intel Corporation
• Original Assignee: Intel Corporation
• Inventors: Vanantwerp, Mark A., Love, William W., Bickerstaff, Cynthia L., Sedayao, Jeffrey C., Widmer, Lawrence J., Purcell, Stacy P.
• Primary Examiner(s): BOUTAH, ALINA A
• Application Number:
  US09/471,964
• Time in Patent Office: 3,407 Days
• Field of Search: 709223-224, 709/238, 709/229, 709/204, 709/233, 709/203, 709/218, 709/227, 707/6, 707/102, 707/1, 707/3, 707/4, 707/7, 714/47, 714/26
• US Class Current: 709/224
• CPC Class Codes: H04L 41/0873 Checking configuration conflicts between network elements
• CPC Class Codes: H04L 41/142 using statistical or mathematical methods
• CPC Class Codes: H04L 41/5009 Determining service level performance parameters or violations of service level contracts, e.g. violations of agreed response time or mean time between failures [MTBF]
• CPC Class Codes: H04L 43/091 Measuring contribution of individual network components to actual service level
• CPC Class Codes: H04L 43/106 using time related information in packets, e.g. by adding timestamps
• CPC Class Codes: H04L 43/16 Threshold monitoring

Abstract

A method, system, and computer program for real-time measurement and modification of the performance of communications on a large area network, such as the Internet, based upon actual user experience. One embodiment performs a statistical analysis of access logs that record actual server usage by users. Based on such analysis, routing of communications over the network can be modified to improve overall communications performance.

Claims

1. A method for real-time measurement of the performance of communications on a large area network between a selected server and a plurality of users at client machines, based upon actual user experience, including:

accessing a server log having user-interaction records indicative of user interactions that occur with one or more applications running on the selected server and that are carried on communications associated with routings through nodes of the network;

determining from the records, assessments of the performance of the communications experienced by the plurality of users;

determining correlations between the assessments of the performance and the routings of the communications;

validating the correlations based on an analysis of two or more parameters associated with the user interactions, wherein the parameters include at least two parameters selected from the group consisting of byte-density, URL count, and unique IP address count, wherein the byte-density is a function of client to server bytes and server to client bytes, and the URL count represents a total number of log entries; and

based on the correlations, modifying one or more of the routings to improve the performance.

2. The method of claim 1, wherein at least one of the nodes is part of a communication path connecting one of the client machines to the selected server.

3. The method of claim 1, further including generating an event notification if a selected statistical analysis value is abnormal.

4. The method of claim 1, further including selecting an aggregation method from a set of aggregation methods for aggregating the user-interaction records according to a parameter.

5. The method of claim 4, wherein the aggregation method includes aggregation by log-file record column data value for each record from the server log.

6. A method as in claim 1, wherein determining assessments comprises applying a statistical analysis that determines time for specified user access relative to a specified interval, and sorts said user access according to a number of times that the application exceeds said interval.

7. A method as in claim 1, wherein said server log includes a time stamp indicating when a record was formed, a client IP address, a time taken to complete transmission, and a size of the transmission.

8. A method as in claim 7, wherein said server log is formed by adding new data entry to the server log, and said server log is closed to further data entry prior to said determining assessments of the performance of the communications.

9. A method as in claim 7, further comprising determining a geographic location from the IP address, and aggregating IP addresses having a specified relationship with a specified geographical location.

10. The method of claim 9, wherein determining a geographic location includes:

defining a database comprising large area network address blocks having geographical or source information;

comparing an address field in each record to the address blocks in the database; and

associating with each record the geographical or source information from an address block matching the address field of the record.

11. The method of claim 10, wherein comparing an address field in each record to the address blocks in the database includes:

defining an array of binary trees for the address blocks in the database, each address block within a binary tree within an array element being masked by a corresponding unique subnet mask value;

masking each address field in each record by a unique subnet value corresponding to a selected array element;

comparing each masked address field to an address field of the address blocks within the binary tree of the selected array element;

outputting selected fields of any matching address block; and

otherwise, continuing the step of comparing with a next selected array element until a match is found or all array elements have been compared.

12. A method as in claim 7, further comprising aggregating said time bins into chronological order and determining trends among said time bins.

13. A method as in claim 7, wherein determining assessments of the performance of the communications comprises determining a computer byte density, transfer fate, and error fraction.

14. A method as in claim 7, wherein determining correlations comprise applying a statistical analysis to assess a performance related measurement against a geographical location of a client.

15. A method as in claim 7, wherein determining correlations comprise applying a statistical analysis to assess a route traversed during use of the one or more applications by an end user.

16. A method as in claim 1, wherein modifying one or more of the routings further comprises determining a new routing.

17. The method of claim 1, further including:

determining exit routing paths from each selected server based on the records from the server log;

determining a best performing exit route based on a statistical analysis of records from the server log;

biasing incoming and outgoing communications with respect to each server to use the determined best performing exit route.

18. The method of claim 1, wherein determining assessments further comprises:

filtering out selected records from the server log, wherein the filtering removes the selected records from further consideration;

aggregating records from the server log into a plurality of aggregate slots, each slot having at least one time bin which represents an interval of time, based on an aggregation method;

performing at least one statistical analysis separately on each time bin of each aggregate slot; and

outputting the results of such statistical analysis as an indication of actual access-to-server usage by users.

19. The method of claim 1, wherein the parameters associated with the user interactions include URL count and unique IP address count.

20. A system for real-time measurement of the performance of communications on a large area network between a selected server and a plurality of users at client machines, based upon actual user experience, including:

a server log having user-interaction records with data indicative of user interactions that occur with one or more applications running on the selected server and that are carried on communications associated with routings through nodes of the network one or more processors configured to determine from the records, assessments of the performance of the communications experienced by the plurality of users;

determine correlations between the assessments and the routings;

validate the correlations based on an analysis of two or more parameters associated with the user interactions, wherein the parameters associated with the user interactions include at least two parameters selected from the group consisting of byte-density, URL count, and unique IP address count, wherein the byte-density is a function of client to server bytes and server to client bytes, and the URL count represents a total number of log entries; and

based on the correlations, generate a command for modifying one or more of the routings to improve the performance.

21. The system of claim 20, wherein at least one of the nodes is part of a communication path connecting one of the client machines to the selected server.

22. The system of claim 20, further including means for generating an event notification if a selected statistical analysis value is abnormal.

23. The system of claim 20, further including means for selecting an aggregation method from a set of aggregation methods for aggregating the user-interaction records according to a parameter.

24. The system of claim 23, wherein the aggregation method includes aggregation by log-file record column data value for each record from the server log.

25. A system as in claim 20, wherein said server log includes a time stamp indicating when a record was formed, a client IP address, a time taken to complete transmission, and a size of the transmission.

26. A system as in claim 25, wherein said server log is formed by added new data as entries to the server log, and said server log is closed to further data entry prior to said determining assessments.

27. A system as in claim 25, wherein said one or more processors converts the IP address into a geographical location, and aggregates IP addresses having a specified relationship with a specified geographical location.

28. A system as in claim 25, wherein said statistical analysis is an assessment of performance related measurement against a geographical location of a client.

29. A system as in claim 25, wherein the one or more processors are configured to determine an assessment of a route traversed during use of the one or more applications by an end user.

30. A system as in claim 20, further comprising a communication routing part, determining a new routing.

31. The system of claim 20, further comprising:

means for determining geographical or source information for each record; and

means for selecting an aggregation method to aggregate records based on such geographical or source information.

32. The system of claim 31, wherein the means for determining geographical or source information for each record includes:

a database comprising large area network address blocks having geographical or source information;

a comparison function for comparing an address field in each record to the address blocks in the database; and

an associating function for associating with each record the geographical or source information from an address block matching the address field of the record.

33. The system of claim 32, wherein the comparison function includes:

an array of binary trees from the address blocks in the database, each address block within a binary tree within an array element being masked by a corresponding unique subnet mask value;

means for masking each address field in each record by a unique subnet value corresponding to a selected array element;

means for comparing each masked address field to an address field of the address bocks within the binary tree of the selected array element;

means for outputting selected fields of any matching address block; and

means for otherwise continuing the step of comparing with a next selected array element until match is found or all array elements have been compared.

34. The system of claim 20, further including:

means for determining exit routing paths for each selected server based on the records from the server log;

means for determining a best performing exit route based on a statistical analysis of records from the server log;

means for biasing incoming and outgoing communications with respect to each server to use the determined best performing exit route.

35. The system of claim 20, wherein the one or more processors are further configured to:

filter out selected records from the server log, wherein the selected records are removed from further consideration;

aggregate records from the server log into a plurality of aggregate slots, each having at least one time bin, based on an aggregation method;

perform at least one statistical analysis of each time bin, representing a time interval, of each aggregate slot; and

output the results of each statistical analysis as an indication of actual server usage by users.

36. The system of claim 20, wherein the parameters associated with the user interactions include URL count and unique IP address count.

37. A computer program, stored on a tangible computer-readable medium, for real-time measurement of the performance of communications on a large area network between a selected server and a plurality of users at client machines, based upon actual user experience, the computer program comprising instructions for causing a computer system to:

access a server log having user-interaction records indicative of user interactions that occur with one or more applications running on the selected server and that are carried on communications associated with routings through nodes of the network;

determine from the records, assessments of the performance of the communications experienced by the plurality of users;

determine correlations between the assessments and the routings;

validate the correlations based on an analysis of two or more parameters associated with the user interactions, wherein the parameters associated with the user interactions include at least two parameters selected from the group consisting of byte-density, URL count, and unique IP address count, wherein the byte-density is a function of client to server bytes and server to client bytes, and the URL count represents a total number of log entries; and

based on the correlations, modify one or more of the routings to improve the performance.

38. The computer program of claim 37, wherein at least one of the nodes is part of a communication path connecting one of the client machines to the selected server.

39. The computer program of claim 37, further including instructions for causing the computer system to generate an event notification if a selected statistical analysis value is abnormal.

40. The computer program of claim 37, further including instructions for causing the computer system to select an aggregation method from a set of aggregation methods for aggregating the user-interaction records according to a parameter.

41. The computer program of claim 40, wherein the aggregation method includes aggregation by log-file record column data for each record from the server log.

42. The computer program as in claim 37, wherein said instructions to access the server log comprises instructions to access a server log that includes time information about records, client IP address, time taken to compete a transmission, and a size of the transmission.

43. The computer program as in claim 42, further comprising instructions to convert the IP address into information indicative of a geographical location, and to aggregate the information according to the geographical location.

44. The computer program as in claim 43, further comprising instructions to perform a statistical analysis of performance versus geographical location of the client.

45. The computer program as in claim 43, further comprising instructions to perform a statistical analysis assessing a route traversed during a network application.

46. The computer program as in claim 37 further comprising additional instructions to determine a new routing.

47. The computer program of claim 37, further including instructions for causing the computer system to:

determine geographical or source information for each record; and

select an aggregation method to aggregate records based on such geographical or source information.

48. The computer program of claim 47, wherein the instructions for causing the computer systems to determine geographical or source information for each record further include instructions for causing the computer system to:

define a database comprising large area network address blocks having geographical or source information;

compare an address field in each record to the address blocks in the database; and

associate with each record the geographical or source information from an address block matching the address field of the record.

49. The computer program of claim 48, wherein the instructions for causing the computer system to compare an address field in each record to the address blocks in the database include instructions for causing the computer system to:

define an array of binary trees for the address blocks in the database, each address block within a binary tree within an array element being masked by a corresponding unique subnet mask value;

make each address field in each record by a unique subnet value corresponding to a selected array element;

compare each masked address field to an address field of the address blocks within the binary tree of the selected array element;

output selected fields of any matching address block; and

otherwise, continue the step of comparing with a next selected array element until a match is found or all array elements have been compared.

50. The computer program of claim 37, further including instructions for causing the computer system to:

determine exit routing paths from each selected server based on the records from the server log;

determine a best performing exit route based on a statistical analysis of records from the server log;

bias incoming and outgoing communications with respect to each server to use the determined best performing exit route.

51. The computer program of claim 37, further including instructions for causing the computer system to:

filter out selected records from the server log, wherein the selected records are removed from further consideration;

aggregate records from the server log into a plurality of aggregate slots, each having at least one time bin, based on an aggregation method;

perform at least one statistical analysis of each time bin, representing a time interval, of each aggregate slot; and

output the results of each statistical analysis as an indication of actual server usage by users.

52. The computer program of claim 37, wherein the parameters associated with the user interactions include URL count and unique IP address count.