Real-time activity monitoring and reporting

• US 7,962,616 B2
• Filed: 09/19/2005
• Issued: 06/14/2011
• Est. Priority Date: 08/11/2005
• Status: Expired due to Fees

• Current Assignee: Micro Focus Incorporated (Open Text Corporation)
• Original Assignee: Micro Focus Incorporated (Open Text Corporation)
• Inventors: Kupferman, Michael, Hardonag, Ido
• Primary Examiner(s): VU, VIET DUY
• Application Number:
  US11/230,987
• Publication Number:
  US 20070039049A1
• Time in Patent Office: 2,094 Days
• Field of Search: 709/217, 709/219, 709/223, 709/224, 709/227, 709/225, 709/250, 719/328, 719/329, 726/22, 726/23, 726/24
• US Class Current: 709/225
• CPC Class Codes: G06F 11/3495 for systems
• CPC Class Codes: H04L 43/028 by filtering
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection

Abstract

In order to track activities in a computerized system with client-server or other communications, a system configuration is needed which monitors, logs and reports traffic. This is somewhat akin to but not entirely similar a firewall. Thus, the invention contemplates a real-time, platform-independent, rule-based activity monitor for detecting a particular activity of interest as it occurs and for reporting such activity and the user substantially as fast.

Claims

1. A method, comprising:

in a computerized private network system with a host and one or more clients in communication with the host, instantiating a client session associated with a particular client that interfaces with a server application on the host, the server application having one or more screens associated therewith, each screen containing one or more fields;

establishing in an application-layer monitor a connection with the server application for the instantiated client session, the application-layer monitor being deployed on the host and logically interposed between the server application on the host and the particular client;

selecting a field from the one or more fields;

defining a rule configured to monitor the field for a pre-set condition, the rule initiating an action when the rule is met;

associating the rule to the field; and

uploading the rule to the application-layer monitor for subsequent run-time use, the application-layer monitor being configured to substantially in real-time copy all communications between the client and the application on the host and to apply the rule to-field to evaluate activity embodied in client-server communications to determine whether the evaluated activity meets the rule, the action being configured to initiate when the evaluated activity meets the rule.

2. A method as in claim 1, wherein the rule is defined using a wizard at the host.

3. A method as in claim 1, wherein the rule is incorporated in an XML instruction file.

4. A method as in claim 1, further comprising recording the client session, and wherein the action is replaying of the recorded client session.

5. An apparatus comprising:

means for, in a computerized private network system with a host and one or more clients in communication with the host, instantiating a client session associated with a particular client that interfaces with a server application on the host, the server application having one or more screens associated therewith, each screen containing one or more fields;

means for establishing in an application-layer monitor a connection with the server application for the instantiated client session, the application-layer monitor being deployed on the host and logically interposed between the server application on the host and the particular client;

means for selecting a field from the one or more fields;

means for defining a rule configured to monitor the field for a pre-set condition, the rule initiating an action when the rule is met;

means for associating the rule to the field; and

means for uploading the rule to the application-layer monitor for subsequent run-time use, the application-layer monitor being configured to substantially in real-time copy all communications between the client and the application on the host and to apply the rule to the field to evaluate activity embodied in client-server communications to determine whether the evaluated activity meets the rule, the action being configured to initiate when the evaluated activity meets the rule.

6. A program storage device readable by a machine, embodying a program of instructions executable by the machine to perform a method, the method comprising:

in a computerized private network system with a host and one or more clients in communication with the host, instantiating a client session associated with a particular client that interfaces with a server application on the host, the server application having one or more screens associated therewith, each screen containing one or more fields;

establishing in an application-layer monitor a connection with the server application for the instantiated client session, the application-layer monitor being deployed on the host and logically interposed between the server application on the host and the particular client;

selecting a field from the one or more fields;

defining a rule configured to monitor the field for a pre-set condition, the rule initiating an action when the rule is met;

associating the rule to the field; and

uploading the rule to the application-layer monitor for subsequent run-time use, the application-layer monitor being configured to substantially in real-time copy all communications between the client and the application on the host and to apply the rule to the field to evaluate activity embodied in client-server communications to determine whether the evaluated activity meets the rule, the action being configured to initiate when the evaluated activity meets the rule.