Network transaction discovery

• US 8,560,684 B2
• Filed: 06/30/2011
• Issued: 10/15/2013
• Est. Priority Date: 06/15/2005
• Status: Active Grant

• Current Assignee: BMC Software Incorporated (KKR & Co., Inc.)
• Original Assignee: BMC Software Incorporated (KKR & Co., Inc.)
• Inventors: Ernst, Theodore R.
• Primary Examiner(s): Barry, Lance L
• Application Number:
  US13/174,744
• Publication Number:
  US 20110264801A1
• Time in Patent Office: 838 Days
• Field of Search: 709/224, 709/203
• US Class Current: 709/224
• CPC Class Codes: G06Q 20/10 specially adapted for electronic funds transfer [EFT] systems; specially adapted for home banking systems
• CPC Class Codes: H04L 43/0876 Network utilisation, e.g. volume of load or congestion level

Abstract

Disclosed herein is a computer implemented technique for discovering the information technology resources that are involved in a particular networked business transaction. The system comprises three basic components. A robotic transaction playback client records the various steps in a particular transaction and can repetitively execute these steps to analyze the results. A network record collector observes the traffic throughout the network in response to the repeated instances of the transaction executed by the robotic transaction playback client. A backend processor analyzes the observations of network traffic to determine which ones are possibly tied to the transaction, and from this information determine which network components are part of the transaction being analyzed. Event timing information from a plurality of executions of a particular transaction are used to determine resource usage and paths.

Claims

1. A system for identifying server resources used in one or more network transactions, the system comprising:

a robotic transaction playback client configured to record and replay the one or more network transactions related to a client and the server resources during a time interval;

a network record collector configured to record network traffic information including discrete events during the time interval of the one or more network transactions; and

a backend processor configured to analyze the network traffic information including the discrete events recorded during the time interval by the network record collector in response to replay of the one or more network transactions by the robotic transaction playback client and identify a specific server resource from the server resources used in the one or more network transactions with the client based on the analysis of the network traffic information including the discrete events during the time interval.

2. The system of claim 1 wherein the robotic transaction playback client is configured to replay the one or more network transactions at varying times.

3. The system of claim 2 wherein the robotic transaction playback client is configured to replay the one or more network transactions under varying network traffic conditions.

4. The system of claim 3 wherein the network traffic information recorded by the network record collector includes one or more parameters including one or more of originating network address, originating network port, destination network address, destination network port, message size, number of responses to a request, and a timestamp.

5. The system of claim 1 wherein analyzing the network traffic information recorded by the network record collector in response to replaying of the one or more network transactions executed by the robotic transaction playback client to identify the specific server resource from the server resources used in the one or more network transactions includes identifying a plurality of nodes belonging to a single logical group of nodes and identifying any of the plurality as a single node.

6. A method of identifying network server resources involved in a network transaction, the method comprising:

recording one or more components of the network transaction related to a client and the network server resources during a time interval;

executing the recorded network transaction one or more times during the time interval;

recording discrete event information by collecting one or more data sets from a plurality of network probes with each of the one or more data sets uniquely corresponding to at least one execution of the recorded network transaction; and

analyzing the collected data sets related to the discrete event information recorded during the time interval in response to each execution of the network transaction and identifying the network server resources including a specific network server resource from the network server resources involved in the network transaction with the client based on the analysis of the collected data sets during the time interval.

7. The method of claim 6 wherein analyzing the collected data further comprises:

identifying a beginning time of the transaction during the time interval by identifying the time of an initial request sent by a client executing the transaction;

identifying an ending time of the transaction during the time interval by identifying the time of a response to the initial request; and

identifying a first network resource of the network resources involved in the transaction by identifying the destination of the initial request.

8. The method of claim 7 wherein analyzing the collected data further comprises:

identifying one or more request/response pairs sent/received by the first network resource between the beginning time of the transaction and the ending time of the transaction; and

identifying one or more potential additional network resources of the network resources potentially in the transaction by identifying the destination/source of each of the identified request/response pairs.

9. The method of claim 8 further comprising recursively analyzing data of the collected data sets to eliminate one or more network resources of the network resources not involved in the transaction.

10. The method of claim 8 wherein identifying one or more potential additional network resources further comprises assigning a probability to each potential additional network resource.

11. The method of claim 10 wherein the probability is heuristically determined.

12. The method of claim 10 wherein assigning a probability to each potential network resource comprises:

identifying a plurality of network paths potentially corresponding to the transaction;

assigning equal base probabilities to each of the plurality of network paths;

analyzing one or more additional parameters relating to network traffic observed on each of the plurality of network paths and flagging each of the plurality of network paths wherein the one or more additional parameters indicate a stronger correlation with the transaction; and

assigning new probabilities to each of the plurality of network paths, wherein the new probability for each flagged path increased and the new probability for each remaining path is decreased relative to the base probabilities.

13. The method of claim 12 wherein assigning new probabilities to each of the plurality of network paths further comprises:

for each flagged network path, increasing the base probability by a predetermined percentage of the base probability multiplied by the number of nodes by which an endpoint of the network path is removed from a client originating the transaction to generate an intermediate probability;

summing the intermediate probabilities for each flagged network path and the base probabilities for each non-flagged network path to obtain a new probability sum; and

assigning a new probability for each network path wherein, for each flagged network path, the new probability is the intermediate probability divided by the new probability sum, and wherein, for each non-flagged network path, the new probability is the base probability divided by the new probability sum.

14. The method of claim 6 wherein analyzing the collected data sets and identifying network resources involved in the transaction comprises identifying a plurality of nodes belonging to a single logical group of nodes and thenceforth identifying each of the plurality of nodes as a single node.

15. A non-transitory machine readable medium, having embodied thereon instructions executable by the machine to perform a method according to claim 6.

16. A non-transitory machine readable medium, having embodied thereon instructions executable by the machine to perform a method according to claim 9.

17. A non-transitory machine readable medium, having embodied thereon instructions executable by the machine to perform a method according to claim 10.

18. A non-transitory machine readable medium, having embodied thereon instructions executable by the machine to perform a method according to claim 11.

19. A non-transitory machine readable medium, having embodied thereon instructions executable by the machine to perform a method according to claim 12.

20. A non-transitory machine readable medium, having embodied thereon instructions executable by the machine to perform a method according to claim 13.