Semantic application logging and analytics

• US 9,298,696 B2
• Filed: 06/04/2014
• Issued: 03/29/2016
• Est. Priority Date: 12/20/2012
• Status: Active Grant

• Current Assignee: Bank of America Corp.
• Original Assignee: Bank of America Corp.
• Inventors: Marian, Radu, Castillo, Paul J., Sito, Gregory
• Primary Examiner(s): Baker, Charlotte M
• Application Number:
  US14/296,143
• Publication Number:
  US 20140288923A1
• Time in Patent Office: 664 Days
• Field of Search: 704/10, 705/3, 705/2, 707/758, 707/755
• US Class Current: 1/1
• CPC Class Codes: G06F 11/30 Monitoring
• CPC Class Codes: G06F 11/3476 Data logging G06F11/14, G06F11/2205 take precedence
• CPC Class Codes: G06F 16/367 Ontology
• CPC Class Codes: G06F 40/242 Dictionaries
• CPC Class Codes: G06Q 10/00 Administration; Management

Abstract

A system for managing dictionaries, such as an application dictionary and a domain dictionary, and for adding entries to a data log is described herein. The system may, in response to a determination that an event occurs at an application, determine that the application uses a first concept name from the application dictionary to describe the event. An entry for the event may be added to a data log for the application. The entry may also include the first concept name from the application dictionary. A mapping of the first concept name from the application dictionary to a second concept name from the domain dictionary may be generated. In some aspects, the data log may be sent to a data log analysis system capable of accessing the domain dictionary.

Claims

1. A method comprising:

determining that a data security event or a data logging event occurs at an application running on a computing domain;

in response to determining that the data security event or the data logging event occurs at the application running on the computing domain, determining, by a computing device having a processor and memory, that the application uses a first concept name from an application dictionary associated with the application to describe the data security event or the data logging event;

generating, by the computing device, an entry for the data security event or the data logging event and adding the entry to a data log for the application running on the computing domain, wherein the entry includes the first concept name from the application dictionary associated with the application;

determining, by the computing device, that the first concept name from the application dictionary corresponds to a second concept name from a domain dictionary associated with a plurality of applications running on the computing domain; and

generating a mapping of the first concept name from the application dictionary to the second concept name from the domain dictionary associated with the plurality of applications running on the computing domain.

2. The method of claim 1, wherein generating the mapping comprises generating a mapping file that identifies the domain dictionary, the first concept name from the application dictionary, and a concept identifier for the data security event or the data logging event.

3. The method of claim 2, wherein the mapping file does not identify the second concept name from the domain dictionary.

4. The method of claim 2, wherein the mapping file comprises a JavaScript Object Notation for Linked Data (JSON-LD) file.

5. The method of claim 1, wherein the domain dictionary comprises a plurality of concept names including the second concept name, and wherein each of the plurality of concept names corresponds to a concept identifier.

6. The method of claim 5, wherein the domain dictionary comprises a JavaScript Object Notation for Linked Data (JSON-LD) file.

7. The method of claim 1, wherein generating the mapping comprises:

associating the first concept name from the application dictionary to a concept identifier; and

associating the second concept name from the domain dictionary to the concept identifier.

8. The method of claim 1, further comprising:

in response to a determination that a second event occurs at the application, determining, by the computing device, that the application uses a third concept name from the domain dictionary to describe the second event; and

adding a second entry for the second event to the data log for the application, wherein the second entry includes the third concept name from the domain dictionary.

9. The method of claim 1, further comprising:

sending the data log to a data log analysis system, wherein the data log analysis system is capable of accessing the domain dictionary.

10. A non-transitory computer-readable medium storing computer-readable instructions that, when read by a computing device, cause the computing device to:

in response to a determination that an event occurs at an application, determine that the application uses a first concept name from an application dictionary to describe the event;

add an entry for the event to a data log for the application, wherein the entry includes the first concept name from the application dictionary; and

generate a mapping of the first concept name from the application dictionary to a second concept name from a domain dictionary, wherein the domain dictionary is different from the application dictionary, wherein generating the mapping comprises generating a mapping file that identifies the domain dictionary, the first concept name from the application dictionary, and a concept identifier for the event, and wherein the mapping file comprises a JavaScript Object Notation for Linked Data (JSON-LD) file.

11. The non-transitory computer-readable medium of claim 10, storing computer-readable instructions that, when read by the computing device, further cause the computing device to:

send the data log to a data log analysis system, wherein the data log analysis system is capable of accessing the domain dictionary.

12. The non-transitory computer-readable medium of claim 10, wherein the mapping file does not identify the second concept name from the domain dictionary.

13. The non-transitory computer-readable medium of claim 10, storing computer-readable instructions that, when read by the computing device, further cause the computing device to:

in response to a determination that a second event occurs at the application, determine that the application uses a third concept name from the domain dictionary to describe the second event; and

add a second entry for the second event to the data log for the application, wherein the second entry includes the third concept name from the domain dictionary.

14. The non-transitory computer-readable medium of claim 10, wherein the domain dictionary comprises a plurality of concept names including the second concept name, and wherein each of the plurality of concept names corresponds to a concept identifier.

15. The non-transitory computer-readable medium of claim 14, wherein the domain dictionary comprises a JavaScript Object Notation for Linked Data (JSON-LD) file.

16. The non-transitory computer-readable medium of claim 10, wherein generating the mapping comprises:

associating the first concept name from the application dictionary to the concept identifier; and

associating the second concept name from the domain dictionary to the concept identifier.

17. An apparatus comprising:

a processor; and

memory storing computer-executable instructions that, when executed by the processor, cause the apparatus to;

determine that a data security event or a data logging event occurs at an application running on a computing domain;

in response to determining that the data security event or the data logging event occurs at the application running on the computing domain, determine that the application uses a first concept name from an application dictionary associated with the application to describe the data security event or the data logging event;

generate an entry for the data security event or the data logging event and add the entry to a data log for the application running on the computing domain, wherein the entry includes the first concept name from the application dictionary associated with the application;

determine that the first concept name from the application dictionary corresponds to a second concept name from a domain dictionary associated with a plurality of applications running on the computing domain; and

generate a mapping of the first concept name from the application dictionary to the second concept name from the domain dictionary associated with the plurality of applications running on the computing domain.

18. The apparatus of claim 17, wherein generating the mapping comprises:

associating the first concept name from the application dictionary to a concept identifier; and

associating the second concept name from the domain dictionary to the concept identifier.