System and method for analyzing remote traffic data in a distributed computing environment

• US 8,195,794 B2
• Filed: 05/05/2010
• Issued: 06/05/2012
• Est. Priority Date: 02/14/1997
• Status: Expired due to Fees

• Current Assignee: Oracle International Corporation (Oracle Corporation)
• Original Assignee: WebTrends Incorporated (WebTrends Holding, Inc.)
• Inventors: Boyd, William Glen, Shapira, Elijahu
• Primary Examiner(s): Coulter, Kenneth R
• Application Number:
  US12/774,421
• Publication Number:
  US 20100217767A1
• Time in Patent Office: 762 Days
• Field of Search: 709/224, 709/223, 709/203, 709217-219
• US Class Current: 709/224
• CPC Class Codes: H04L 43/00 Arrangements for monitoring or testing data switching networks
• CPC Class Codes: H04L 43/045 for graphical visualisation of monitoring data
• CPC Class Codes: H04L 43/06 Generation of reports
• CPC Class Codes: H04L 43/062 related to network traffic
• CPC Class Codes: H04L 43/14 using software, i.e. software packages network security related monitoring H04L63/1408
• CPC Class Codes: H04L 43/18 Protocol analysers
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]
• CPC Class Codes: H04L 67/125 involving control of end-device applications over a network
• CPC Class Codes: H04L 67/535 Tracking the activity of the user network monitoring arrangements H04L43/00; recording of computer activity G06F11/34
• CPC Class Codes: H04L 67/75 Indicating network or usage conditions on the user display

Abstract

A system, method and storage medium embodying computer-readable code for analyzing traffic data in a distributed computing environment are described. The distributed computing environment includes a plurality of interconnected systems operatively coupled to a server, a source of traffic data hits and one or more results tables categorized by an associated data type. Each results table includes a plurality of records. The server is configured to exchange data packets with each interconnected system. Each traffic data hit corresponds to a data packet exchanged between the server and one such interconnected system. Each traffic data hit is collected from the traffic data hits source as access information into one such record in at least one results table according to the data type associated with the one such results table. Each of the records in the results table corresponds to a different type of access information for the data type associated with the results table. The access information collected into the results tables during a time slice is summarized periodically into analysis results. The time slice corresponds to a discrete reporting period. The access information is analyzed from the results tables in the analysis results to form analysis summaries according to the data types associated with the results tables.

Claims

1. A computer-implemented method for deinflating traffic data in a distributed computing environment, the method comprising:

analyzing traffic data from one or more sources;

storing access information derived from the traffic data in one or more results tables associated with a first time slice;

at the end of the first time slice, summarizing the one or more results tables into a first container file;

storing the first container file in analysis results for the first time slice;

storing a number of open user sessions remaining at the end of the first time slice in the analysis results;

storing access information derived from the traffic data in one or more results tables associated with a second time slice;

at the end of the second time slice, summarizing the one or more results tables into a second container file;

storing the second container file in analysis results for the second time slice; and

adjusting the analysis results for the second time slice according to the number of open user sessions remaining at the end of the first time slice,

wherein adjusting the analysis results comprises deducting the number of open sessions remaining at the end of the first time slice from the analysis results for the second time slice.

2. The computer-implemented method of claim 1, further comprising:

adjusting a user session count for consecutive time slices by the number of open user sessions remaining at the end of one of the consecutive time slices.

3. The computer-implemented method of claim 1, further comprising:

storing the number of open user sessions remaining at the end of the time slice in a user session table.

4. The computer-implemented method of claim 3, further comprising:

making an entry in the user session table pointing to a corresponding one of a plurality of microtables.

5. The computer-implemented method of claim 4, further comprising:

forming indexes within each of the plurality of microtables, each index pointing to a record within the one or more results tables.

6. The computer-implemented method of claim 5, wherein the index points to the record within the one or more results tables to indicate an inflated count of user sessions.

7. The computer implemented method of claim 3, further comprising:

counting a number of user sessions for the time slice;

storing the user session count in the user session table; and

adjusting the user session count for consecutive time slices by the number of open user sessions remaining at the end of the time slice.

8. A storage medium embodying computer-readable code for analyzing traffic data in a distributed computing environment, comprising:

means for initializing first results tables associated with a first time slice;

means for parsing traffic data to extract access information;

means for storing the access information in the first results tables;

means for summarizing the first results tables into analysis results for the first time slice;

means for storing the analysis results;

means for storing a number of open user sessions remaining at the end of the first time slice in the analysis results;

means for initializing second results tables associated with a second time slice;

means for storing the access information in the second results tables;

means for summarizing the second results tables into analysis results for the second time slice;

means for storing the analysis results for the second time slice; and

means for adjusting the analysis results for the second time slice according to the number of open user sessions remaining at the end of the first time slice,

wherein the means for adjusting includes means for deducting the number of open sessions remaining at the end of the first time slice from the analysis results for the second time slice.

9. A system for analyzing traffic data in a distributed computing environment, comprising:

a plurality of first results tables associated with a first time slice;

means for parsing traffic data to extract access information;

means for storing the access information in the first results tables;

a container file configured to store a summarization of the first results tables;

means for storing the container file into analysis results for the first time slice;

means for storing a number of open user sessions remaining at the end of the first time slice in the analysis results;

a plurality of second results tables associated with a second time slice;

means for storing the access information in the second results tables;

means for summarizing the second results tables into analysis results for the second time slice;

a second container file configured to store a summarization of the second results tables;

means for storing the second container file into analysis results for the second time slice; and

means for adjusting the analysis results for the second time slice according to the number of open user sessions remaining at the end of the first time slice,

wherein the means for adjusting includes means for deducting the number of open sessions remaining at the end of the first time slice from the analysis results for the second time slice.

10. A computer-implemented method for deinflating traffic data in a distributed computing environment, the method comprising:

analyzing traffic data from one or more sources;

storing access information derived from the traffic data in one or more results tables associated with a time slice;

at the end of the time slice, summarizing the one or more results tables into a container file;

storing the container file in analysis results for the time slice;

storing a number of open user sessions remaining at the end of the first time slice in the analysis results;

storing the number of open user sessions remaining at the end of the time slice in a user session table;

making an entry in the user session table pointing to a corresponding one of a plurality of microtables; and

forming indexes within each of the plurality of microtables, each index pointing to a record within the one or more results tables,

wherein the index points to the record within the one or more results tables to indicate an inflated count of user sessions.

11. The computer implemented method of claim 10, further comprising:

counting a number of user sessions for the time slice;

storing the user session count in the user session table; and

adjusting the user session count for consecutive time slices by the number of open user sessions remaining at the end of the time slice.

12. The computer-implemented method of claim 10, wherein the time slice comprises a first time slice, and the container file comprises a first container file, the method further comprising:

storing access information derived from the traffic data in one or more results tables associated with a second time slice;

at the end of the second time slice, summarizing the one or more results tables into a second container file;

storing the second container file in analysis results for the second time slice; and

adjusting the analysis results for the second time slice according to the number of open user sessions remaining at the end of the first time slice.

13. The computer-implemented method of claim 12, wherein adjusting the analysis results comprises deducting the number of open sessions remaining at the end of the first time slice from the analysis results for the second time slice.