Method and apparatus for intelligent capture of document object model events

• US 9,495,340 B2
• Filed: 03/26/2014
• Issued: 11/15/2016
• Est. Priority Date: 06/30/2006
• Status: Active Grant

• Current Assignee: Acoustic, L.P.
• Original Assignee: International Business Machines Corporation
• Inventors: Caspi, Nadav, Powell, Travis Spence, Singhania, Ashwin, Wenig, Robert I.
• Primary Examiner(s): Chen, Alan
• Application Number:
  US14/226,378
• Publication Number:
  US 20140208200A1
• Time in Patent Office: 965 Days
• Field of Search: None
• US Class Current: 1/1
• CPC Class Codes: G06F 16/93 Document management systems
• CPC Class Codes: G06F 16/986 Document structures and storage, e.g. HTML extensions
• CPC Class Codes: G06F 40/143 Markup, e.g. Standard Generalized Markup Language [SGML] or Document Type Definition [DTD]
• CPC Class Codes: G06F 40/194 Calculation of difference between files
• CPC Class Codes: G06Q 30/0241 Advertisements
• CPC Class Codes: H04L 41/00 Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
• CPC Class Codes: H04L 43/028 by filtering
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]
• CPC Class Codes: H04L 67/142 Managing session states for stateless protocols; Signalling session states; State transitions; Keeping-state mechanisms

Abstract

A monitoring system intelligently captures Document Object Model (DOM) events. The DOM events may provide state information that may not usually be captured during a web session. To reduce processing bandwidth, content identifiers may be used to represent some DOM events. Checkpoints may be identified during the web session and a current state of the webpage may be captured to provide replay synchronization. Different data may be captured based on a sequence and timing of the DOM events during the original web session. Data exchanged with third party websites also may be selectively captured to provide a more through simulation of the original web session.

Claims

1. A method, comprising:

monitoring, by a processing device, for changes in a webpage during a web session;

identifying, by the processing device, some of the changes in the webpage that can be represented by associated content identifiers that represent information in known DOM items, wherein the changes in the webpage comprise Document Object Model (DOM) events;

capturing, by the processing device, the webpage by representing the identified changes in the webpage with the associated content identifiers;

referencing a table during replaying of the web session, the content identifiers being used to index the table to identify associated text; and

displaying, during the replaying, the identified associated text within the webpage.

2. The method of claim 1, further comprising:

configuring an agent to monitor for the changes in the webpage; and

configuring the agent to send the content identifiers representing the identified changes in the webpage to an archive server.

3. The method of claim 1, further comprising:

identifying the changes in the webpage that cannot be represented by associated content identifiers;

capturing the Document Object Model (DOM) events for the changes in the webpage that cannot be represented by associated content identifiers; and

capturing the webpage by combining the DOM events with the content identifiers.

4. The method of claim 1, further comprising:

identifying actions, time stamps, and locations associated with the content identifiers; and

archiving the actions, times, and locations with the associated content identifiers.

5. The method of claim 1 further comprising:

identifying Document Object Model (DOM) subtrees for the changes in the webpage;

identifying DOM values in the DOM subtrees for the changes in the webpage; and

using the content identifiers to represent some of the DOM values.

6. The method of claim 1 further comprising using a Domsubtree Modified JavaScript message to identify the changes in the webpage.

7. The method of claim 1, further comprising:

identifying a sequence and timing of Document Object Model (DOM) events for a web session; and

determining which changes in the webpage to capture and archive based on the sequence and timing of the DOM events.

8. The method of claim 1, further comprising:

identifying metadata for the webpage; and

determining which changes in the webpage to capture and archive based on the metadata for the webpage.

9. The method of claim 1, further comprising:

identifying a checkpoint event; and

capturing a Document Object Model (DOM) state for the webpage in response to identifying the checkpoint event.

10. The method of claim 9, wherein identifying the checkpoint event comprises:

identifying a normal sequence of events for a web session;

monitoring an actual sequence of events for the web session; and

capturing the DOM state for the web page based on a comparison of the normal sequence of events for the web session with the actual sequence of events for the web session.

11. The method of claim 1, further comprising:

identifying network events for a web session;

identifying websites associated with the network events; and

capturing the changes in the webpage based on the websites associated with the network events.

12. The method of claim 11, wherein the websites comprise a primary website providing the webpage and third party websites providing content for the webpage.

13. An apparatus, comprising:

logic circuitry configured to;

monitor a Document Object Model (DOM) for a webpage;

detect changes in the DOM for the webpage;

locate subtrees in the DOM containing the changes in the DOM;

identify some of the changes in the webpage that can be represented by associated content identifiers that represent known DOM items;

capture the webpage of a captured web session by representing the identified changes in the webpage with the associated content identifiers;

reference a table during replaying of the web session, the content identifiers being used to index the table to identify associated text; and

display, during the replaying, the identified associated text within the webpage.

14. The apparatus of claim 13, wherein the logic circuit is further configured to:

identify actions, times, and locations associated with the content identifiers; and

archive the actions, times, and locations with the associated content identifiers.

15. The apparatus of claim 13 wherein the logic circuitry is further configured to use a DOMSUBTREE MODIFIED JavaScript object to identify values in the subtrees for the changes in the DOM.

16. The apparatus of claim 13, wherein the logic circuitry is further configured to:

identify a sequence of events for the web session; and

determine which changes in the DOM to capture based on the sequence of events for the web session.

17. The apparatus of claim 13, wherein the logic circuitry is further configured to:

identify a checkpoint event for the web session; and

capture a DOM state for the webpage in response to identifying the checkpoint event.

18. The apparatus of claim 13, wherein the logic circuitry is further configured to:

identify the changes in the DOM that cannot be represented by associated content identifiers;

capture content from the webpage for the changes in the DOM that cannot be represented by associated content identifiers; and

combine the content from the webpage with the content identifiers as the captured web session.

19. The apparatus of claim 13, wherein the logic circuitry is further configured to:

monitor DOM events for an original web session;

send the DOM events to a session analyzer;

receive a control message back from the session analyzer, wherein the control message is based on the DOM events; and

capture the changes in the DOM based on the control message.

20. The apparatus of claim 13, wherein the logic circuitry is further configured to:

identify browser requests to third party websites;

filter payloads and Uniform Resource Locators for the browser requests;

log the filtered browser requests; and

transmit the logged browser requests to an archive server to provide context to the DOM changes identified in the web session.

21. A method, comprising:

receiving, by a processing device, a webpage captured from a web session;

receiving, by the processing device, Document Object Model (DOM) changes in the webpage from the web session;

identifying changes in the webpage that can be represented by associated content identifiers, the associated content identifiers representing known DOM items;

archiving, by the processing device, at least a portion of the webpage and the content identifiers for subsequent replaying of the web session;

referencing a table during replaying of the web session, the content identifiers being used to index the table to identify associated text; and

displaying, during the replaying, the identified associated text within the webpage.

22. The method of claim 21, further comprising:

archiving the content identifiers instead of the associated DOM changes.

23. The method of claim 21, further comprising:

monitoring DOM events during the web session;

identifying which DOM changes in the webpage to capture based on the DOM events; and

sending a control message directing an agent to capture the identified DOM changes.

24. The method of claim 21, further comprising:

receiving metadata for the webpage;

identifying which DOM changes in the webpage to capture based on the metadata; and

sending a control message directing an agent to capture the identified DOM changes.

25. The method of claim 21, further comprising:

receiving actions, timestamps, and locations associated with the DOM changes;

archiving the actions, timestamps, and locations associated with the DOM changes for subsequent replaying of the web session.

26. The method of claim 21, further comprising:

monitoring DOM events during the web session;

identifying a checkpoint based on the DOM events; and

initiating capture of an entire state of the webpage in response to identifying the checkpoint.

27. The method of claim 21, further comprising:

sending an artificial stimulation of the DOM to the webpage;

receiving DOM events in response to the artificial stimulation of the DOM; and

initiating capture of additional DOM events or generating a status message in response to the received DOM events.