Method and system for generating transaction data from network traffic data for an application system

• US 9,571,342 B2
• Filed: 02/14/2012
• Issued: 02/14/2017
• Est. Priority Date: 02/14/2012
• Status: Active Grant

• Current Assignee: INETCO Systems Ltd.
• Original Assignee: INETCO Systems Ltd.
• Inventors: Chao, Wilson Wai Hang, Telfer, Angus Richard, Jorgenson, Loki
• Primary Examiner(s): Hussain, Tauqir
• Assistant Examiner(s): MOREAU, AUSTIN J
• Application Number:
  US13/396,003
• Publication Number:
  US 20130212255A1
• Time in Patent Office: 1,827 Days
• Field of Search: 709/224
• US Class Current: 1/1
• CPC Class Codes: G06F 40/30 Semantic analysis
• CPC Class Codes: H04L 41/083 for increasing network speed
• CPC Class Codes: H04L 43/028 by filtering
• CPC Class Codes: H04L 43/04 Processing captured monitoring data, e.g. for logfile generation
• CPC Class Codes: H04L 43/10 Active monitoring, e.g. heartbeat, ping or trace-route
• CPC Class Codes: H04L 67/535 Tracking the activity of the user network monitoring arrangements H04L43/00; recording of computer activity G06F11/34

Abstract

A method for generating transaction data from network traffic data for an application system which is distributed across a plurality of network connected nodes, comprising: gathering the network traffic data, the network traffic data including syntactic information; storing the network traffic data and the syntactic information in field-sets; deriving semantic information from the network traffic data and the syntactic information with a first module which implements a first semantic model relating to first transactions, and modifying the field-sets to include the semantic information; passing the field-sets to a second module; deriving additional semantic information from the network traffic data, the syntactic information, and the semantic information with the second module which implements a second semantic model relating to second transactions, and further modifying the field-sets to include the additional semantic information; and, outputting the field-sets from the second module to provide the transaction data for the application system.

Claims

1. A method for monitoring an application system which is distributed across a plurality of network connected nodes by generating transaction data from network traffic data for the application system, comprising:

gathering the network traffic data directly from network traffic passing between the plurality of network connected nodes of the application system, the network traffic data including syntactic information;

storing the network traffic data and the syntactic information in field-sets;

deriving semantic information from the network traffic data and the syntactic information in the field-sets with a first module which implements a first semantic model relating to first transactions within the application system having a first granularity, and modifying the field-sets to include the semantic information;

generating one or more new field sets populated with field members derived from analysis of one or more existing field sets of the field sets and adding the one or more new field sets to the field sets, wherein at least one of the one or more new field sets refers to at least one second transaction of second transactions within the application system having a second granularity, and wherein the one or more new field sets and the one or more existing field sets are of a same form;

assigning respective first universally unique identifiers to field members of each of the one or more existing field sets, assigning respective second universally unique identifiers to field members of each of the one or more new field sets, and including the second universally unique identifiers in respective field members of each of the one or more existing field sets;

passing the field-sets to a second module;

deriving additional semantic information from the network traffic data, the syntactic information, and the semantic information in the field-sets with the second module which implements a second semantic model relating to the second transactions within the application system having the second granularity, the second granularity being coarser than the first granularity, and further modifying the field-sets to include the additional semantic information; and

,

outputting the field-sets from the second module to provide the transaction data for the application system;

wherein the syntactic information pertains to form and content of the network traffic data and wherein the semantic information and the additional semantic information pertain to meaning and context of the network traffic data and the syntactic information in relation to the network traffic and the application system;

wherein the first transactions correspond to a first layer of a hierarchical model for the application system, wherein the second transactions correspond to a second layer of the hierarchical model, wherein the first module and the first semantic model are associated with the first layer, wherein the second module and the second semantic model are associated with the second layer, wherein the first transactions are link transactions, wherein the second transactions are service transactions, wherein the first layer is a network layer, and wherein the second layer is a service layer.

2. The method of claim 1 wherein each field-set includes one or more field members, wherein each field member is a name-value pair, and wherein the one or more field members store the network traffic data, the syntactic information, the semantic information, and the additional semantic information.

3. The method of claim 1 wherein the modifying and the further modifying of the field-sets includes one or more of:

adding one or more field-sets;

deleting one or more field-sets;

combining one or more field-sets;

filtering one or more field-sets; and

, adding, deleting, or modifying one or more field members of one or more field-sets.

4. The method of claim 1 wherein the first module is a first sequence of modules and wherein the second module is a second sequence of modules.

5. The method of claim 1 wherein the first module and the second module form a pipeline of modules.

6. The method of claim 1 wherein the field-sets are stored in a datastore of a monitoring system and wherein references to the field-sets are passed between the first module and the second module.

7. The method of claim 4 wherein the deriving of semantic information and the deriving of the additional semantic information is distributed across the first sequence of modules and the second sequence of modules, respectively, such that the deriving of the semantic information and the deriving of the additional semantic information proceeds incrementally as field-sets are passed from module to module within the first sequence of modules and from module to module within the second sequence of modules.

8. The method of claim 1 and further comprising:

generating the hierarchical model for the application system, the hierarchical model having at least the first layer and the second layer; and

,

mapping the application system onto the hierarchical model according to a network topology of the application system.

9. The method of claim 1 wherein the transaction data is used for monitoring the application system.

10. The method of claim 1 and further comprising:

passing the field-sets to one or more further modules;

deriving further semantic information from the network traffic data, the syntactic information, the semantic information, and the additional semantic information in the field-sets with the one or more further modules which implement one or more further semantic models relating to one or more further transactions within the application system having one or more further granularities, respectively, the one or more further granularities being coarser than the second granularity, and still further modifying the field-sets to include the further semantic information; and

,

outputting the field-sets from the one or more further modules to provide the transaction data for the application system.

11. The method of claim 10 and further comprising:

generating the hierarchical model for the application system, the hierarchical model having at least the first layer, the second layer, and one or more further layers, the one or more further layers corresponding to the one or more further transactions, and the one or more further modules and the one or more further semantic models being associated with the one or more further layers; and

,

mapping the application system onto the hierarchical model according to a network topology of the application system.

12. The method of claim 11 wherein third transactions of the one or more further transactions are application transactions, fourth transactions of the one or more further transactions are business transactions, a third layer of the one or more further layers is an application layer, and a fourth layer of the one or more further layers is a business layer.

13. The method of claim 10 wherein the first module is a first sequence of modules, wherein the second module is a second sequence of modules, and wherein the one or more further modules are one or more further sequences of modules.

14. The method of claim 13 wherein the deriving of semantic information, the deriving of the additional semantic information, and the deriving of the further semantic information is distributed across the first sequence of modules, the second sequence of modules, and the one or more further sequences of modules, respectively, such that the deriving of the semantic information, the deriving of the additional semantic information, and the deriving of the further semantic information proceeds incrementally as field-sets are passed from module to module within the first sequence of modules, from module to module within the second sequence of modules, and from module to module within the one or more further sequences of modules.

15. The method of claim 10 wherein the first module, the second module, and the one or more further modules form a pipeline of modules.

16. The method of claim 10 wherein the field-sets are stored in a datastore of a monitoring system and wherein references to the field-sets are passed between the first module, the second module, and the one or more further modules.

17. The method of claim 10 wherein the first module, the second module, and the one or more further modules are one or more of software and hardware modules.

18. The method of claim 1 wherein the first module and the second module are one or more of software and hardware modules.

19. The method of claim 1 wherein the application system is a financial or banking system.

20. The method of claim 1 and further comprising, prior to the outputting of the field-sets from the second module to provide the transaction data for the application system, dropping field-sets relating only to the first transactions from the field-sets.

21. A system for monitoring an application system which is distributed across a plurality of network connected nodes by generating transaction data from network traffic data for the application system, comprising:

a processor coupled to memory and an interface to the network; and

,

at least one of hardware and software modules within the memory and controlled or executed by the processor, the modules including;

a module for gathering the network traffic data directly from network traffic passing between the plurality of network connected nodes of the application system, the network traffic data including syntactic information;

a module for storing the network traffic data and the syntactic information in field-sets;

a module for deriving semantic information from the network traffic data and the syntactic information in the field-sets with a first module which implements a first semantic model relating to first transactions within the application system having a first granularity, and modifying the field-sets to include the semantic information;

a module for generating one or more new field sets populated with field members derived from analysis of one or more existing field sets of the field sets and adding the one or more new field sets to the field sets, wherein at least one of the one or more new field sets refers to at least one second transaction of second transactions within the application system having a second granularity, and wherein the one or more new field sets and the one or more existing field sets are of a same form;

a module for assigning respective first universally unique identifiers to field members of each of the one or more existing field sets, assigning respective second universally unique identifiers to field members of each of the one or more new field sets, and including the second universally unique identifiers in respective field members of each of the one or more existing field sets;

a module for passing the field-sets to a second module;

a module for deriving additional semantic information from the network traffic data, the syntactic information, and the semantic information in the field-sets with the second module which implements a second semantic model relating to the second transactions within the application system having the second granularity, the second granularity being coarser than the first granularity, and further modifying the field-sets to include the additional semantic information; and

,

a module for outputting the field-sets from the second module to provide the transaction data for the application system;

wherein the syntactic information pertains to form and content of the network traffic data and wherein the semantic information and the additional semantic information pertain to meaning and context of the network traffic data and the syntactic information in relation to the network traffic and the application system;

wherein the first transactions correspond to a first layer of a hierarchical model for the application system, wherein the second transactions correspond to a second layer of the hierarchical model, wherein the first module and the first semantic model are associated with the first layer, wherein the second module and the second semantic model are associated with the second layer, wherein the first transactions are link transactions, wherein the second transactions are service transactions, wherein the first layer is a network layer, and wherein the second layer is a service layer.

22. The system of claim 21 and further comprising, a module for, prior to the outputting of the field-sets from the second module to provide the transaction data for the application system, dropping field-sets relating only to the first transactions from the field-sets.