System and method for analyzing remote traffic data in a distributed computing environment

• US 7,734,772 B2
• Filed: 03/05/2007
• Issued: 06/08/2010
• Est. Priority Date: 02/14/1997
• Status: Expired due to Fees

• Current Assignee: Oracle International Corporation (Oracle Corporation)
• Original Assignee: WebTrends Incorporated (WebTrends Holding, Inc.)
• Inventors: Shapira, Elijahu, Boyd, William Glen
• Primary Examiner(s): Coulter; Kenneth R
• Application Number:
  US11/682,150
• Publication Number:
  US 20070198707A1
• Time in Patent Office: 1,191 Days
• Field of Search: 709/224, 709/223, 709/203, 709/218, 710/1, 710/10, 710/100
• US Class Current: 709/224
• CPC Class Codes: H04L 43/00 Arrangements for monitoring or testing data switching networks
• CPC Class Codes: H04L 43/045 for graphical visualisation of monitoring data
• CPC Class Codes: H04L 43/06 Generation of reports
• CPC Class Codes: H04L 43/062 related to network traffic
• CPC Class Codes: H04L 43/14 using software, i.e. software packages network security related monitoring H04L63/1408
• CPC Class Codes: H04L 43/18 Protocol analysers
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]
• CPC Class Codes: H04L 67/125 involving control of end-device applications over a network
• CPC Class Codes: H04L 67/535 Tracking the activity of the user network monitoring arrangements H04L43/00; recording of computer activity G06F11/34
• CPC Class Codes: H04L 67/75 Indicating network or usage conditions on the user display

Abstract

A system, method and storage medium embodying computer-readable code for analyzing traffic data in a distributed computing environment are described. The distributed computing environment includes a plurality of interconnected systems operatively coupled to a server, a source of traffic data hits and one or more results tables categorized by an associated data type. Each results table includes a plurality of records. The server is configured to exchange data packets with each interconnected system. Each traffic data hit corresponds to a data packet exchanged between the server and one such interconnected system. Each traffic data hit is collected from the traffic data hits source as access information into one such record in at least one results table according to the data type associated with the one such results table. Each of the records in the results table corresponds to a different type of access information for the data type associated with the results table. The access information collected into the results tables during a time slice is summarized periodically into analysis results. The time slice corresponds to a discrete reporting period. The access information is analyzed from the results tables in the analysis results to form analysis summaries according to the data types associated with the results tables.

Claims

1. A system for analyzing traffic data in a distributed computing environment, the distributed computing environment comprising a plurality of interconnected systems, the interconnected systems including at least one hardware system, the interconnected systems operatively coupled to a hardware server, the server configured to receive hits from each interconnected system, comprising:

one or more static results tables, each static results table comprising a plurality of records;

one or more dynamic results tables categorized by an associated data type, each dynamic results table comprising a plurality of records;

means for collecting each hit as access information into one such record in at least one dynamic results table according to the data type associated with the one such dynamic results table, each of the records in the dynamic results table corresponding to a different type of access information for the data type associated with the dynamic results table;

means for summarizing periodically the access information collected into the dynamic results tables during a time slice into analysis results, the time slice corresponding to a discrete reporting period; and

means for analyzing the access information from the dynamic results tables in the analysis results to form analysis summaries according to the data types associated with the dynamic results tables.

2. A system according to claim 1, wherein each such interconnected system interfaces to the server via one of a network connection, a point-to-point connection and a dedicated connection.

3. A system according to claim 1, wherein the server further comprises a log file operatively coupled to the server and storing the hits, the log file operating as a source of hits responsive to the collecting means.

4. A system according to claim 1, wherein the server further comprises a database operatively coupled to the server and storing at least one of the hits and the analysis results, the database operating as a source of hits responsive to the collecting means.

5. A system according to claim 1, further comprising:

a user session table comprising one or more records which each store a pointer, each pointer corresponding to one of the dynamic results tables, the collecting means including a user session count for each such data type associated with each such dynamic results table, the user session count being stored in the user session table in each of the records; and

one or more microtables, each of the microtables including one or more indices and being associated with one of the dynamic results tables, each such index within the microtable logically referring to each such different type of access information collected in the associated dynamic results table, each such pointer in the user session table further logically referring to one of the microtables, the analyzing means further comprising means for adjusting the user session count for consecutive time slices.

6. A system according to claim 5, further comprising:

a container file comprising a table of contents and configured to store the one or more static results tables, the one or more dynamic results tables, the user sessions table, and the one or more microtables, the summarizing means further comprising means for mapping relative positions of each such static and dynamic results table within the container file into the table of contents and storing each such pointer in the user session table with the relative positions of each such microtable within the container file.

7. A system according to claim 1 wherein the plurality of records in the static results tables includes a fixed and predefined set of records.

8. A computer-implemented method for analyzing traffic data in a distributed computing environment, the method comprising:

storing a plurality of traffic data hits in a storage structure associated with a hardware server;

initializing one or more static results tables;

parsing the traffic data hits from the storage structure associated with the hardware server to extract access information;

storing the access information in one of the static results tables or one of a plurality of dynamic results tables;

summarizing the access information into analysis results, wherein summarizing the access information comprises;

obtaining the results table containing the access information;

copying the results table containing the access information into a container file; and

updating a table of contents of the container file to reflect the relative position of the results table containing the access information within the container file; and

storing the analysis results in the container file.

9. The computer-implemented method of claim 8, wherein storing the plurality of traffic data hits comprises storing the traffic data hits in a log file associated with the storage structure, each traffic data hit is stored in a log file format, and the log file format comprises a plurality of fields.

10. The computer-implemented method of claim 9, wherein the access information includes the contents of the fields of the log file format.

11. The computer-implemented method of claim 8, wherein the access information includes contextual information derived from the traffic data hit.

12. The computer-implemented method of claim 8, further comprising defining a time slice and wherein storing the analysis results in the container file is performed when the time slice is ended.

13. The computer-implemented method of claim 8, wherein storing the access information comprises:

selecting a pertinent results table, the pertinent results table being one of the static results tables or one of the dynamic results tables;

identifying a type of the access information;

identifying a record corresponding to the type of the access information;

creating the record in the pertinent results table if the pertinent results table is a dynamic results table and the record does not exist in the pertinent results table; and

storing the access information in the record of the pertinent results table.

14. A computer-implemented method for analyzing traffic data in a distributed computing environment, the method comprising:

storing a plurality of traffic data hits in a storage structure associated with a hardware server;

initializing one or more static results tables;

parsing the traffic data hits from the storage structure associated with the hardware server to extract access information;

storing the access information in one of the static results tables or one of a plurality of dynamic results tables, wherein storing the access information comprises;

selecting a pertinent results table, the pertinent results table being one of the static results tables or one of the dynamic results tables;

identifying a type of the access information;

identifying a record corresponding to the type of the access information;

creating the record in the pertinent results table if the pertinent results table is a dynamic results table and the record does not exist in the pertinent results table; and

storing the access information in the record of the pertinent results table;

summarizing the access information into analysis results; and

storing the analysis results in a container file.

15. The computer-implemented method of claim 14, wherein storing the plurality of traffic data hits comprises storing the traffic data hits in a log file associated with the storage structure, each traffic data hit is stored in a log file format, and the log file format comprises a plurality of fields.

16. The computer-implemented method of claim 15 wherein the access information includes the contents of the fields of the log file format.

17. The computer-implemented method of claim 14, wherein the access information includes contextual information derived from the traffic data hit.

18. The computer-implemented method of claim 14, further comprising defining a time slice and wherein storing the analysis results in the container file is performed when the time slice is ended.