Methods and computer program products for generating a model of network application health

• US 9,634,915 B2
• Filed: 10/12/2015
• Issued: 04/25/2017
• Est. Priority Date: 08/14/2009
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Inventors: Bley, John B.
• Primary Examiner(s): Keehn, Richard G
• Application Number:
  US14/881,105
• Publication Number:
  US 20160036663A1
• Time in Patent Office: 561 Days
• Field of Search: 709224
• CPC Class Codes: G06F 11/3409 for performance assessment
• CPC Class Codes: G06F 11/3447 Performance evaluation by modeling
• CPC Class Codes: G06F 11/3495 for systems
• CPC Class Codes: G06F 2201/815 Virtual middleware or OS functionality using virtual machines to implement generic software techniques for error detection or fault masking G06F11/1484
• CPC Class Codes: G06F 2201/86 Event-based monitoring
• CPC Class Codes: G06F 2201/87 Monitoring of transactions
• CPC Class Codes: G06F 9/45533 Hypervisors; Virtual machine monitors
• CPC Class Codes: H04L 41/145 involving simulating, designing, planning or modelling of a network
• CPC Class Codes: H04L 43/045 for graphical visualisation of monitoring data
• CPC Class Codes: H04L 43/0864 Round trip delays
• CPC Class Codes: H04L 43/14 using software, i.e. software packages network security related monitoring H04L63/1408
• CPC Class Codes: H04L 67/12 specially adapted for proprietary or special-purpose networking environments, e.g. medical networks, sensor networks, networks in vehicles or remote metering networks
• CPC Class Codes: H04L 67/535 Tracking the activity of the user network monitoring arrangements H04L43/00; recording of computer activity G06F11/34

Abstract

Provided are methods and computer program products for generating a model of network application health. Methods may include receiving activity data that corresponds to activities of multiple applications that are operable to execute on at least one networked device, and combining the received activity data to remove redundant portions thereof and/or to reconcile inconsistencies therein. Based on the received activity data, ones of the multiple applications are identified, and relationships between the identified applications are determined. A model is generated including the identified applications and the relationships therebetween, and a representation of the model is displayed. Related computer program products are also provided.

Claims

1. A method for generating a model of network application health, the method comprising:

receiving activity data that corresponds to activities of a plurality of applications that are operable to execute on at least one networked device;

combining received activity data by removing redundant portions thereof and by reconciling inconsistencies among data received from different ones of the plurality of collector applications therein, wherein after combining the received activity data, the received activity data includes the activity data from the plurality of collector applications without redundant portions thereof;

identifying ones of the plurality of applications and relationships there between based on the received activity data;

generating a model including identified applications and relationships there between; and

displaying a representation of the model;

wherein receiving activity data, combining received activity data, identifying ones of the plurality of applications and relationships therebetween, generating a model, and displaying a representation of the model comprise operations performed using at least one programmed computer processor circuit.

2. The method of claim 1, wherein the at least one networked device comprises a plurality of networked devices, and

wherein receiving activity data comprises receiving activity data from a plurality of collector applications that are operable to execute on respective ones of the plurality of networked devices.

3. The method of claim 1, further comprising:

inferring the existence of a second application for which corresponding activity data was not received based on an identification of a first application for which corresponding activity data was received; and

inferring the relationship between the first and the second applications based on the identification of the first application.

4. The method of claim 1, further comprising storing received activity data and associated data that indicates when the activity data was received,

wherein identifying is based on stored activity data received during a specified time interval.

5. The method of claim 1, wherein the at least one network device comprises a virtual machine, and

wherein receiving activity data comprises receiving activity data from a collector application that is operable to execute within the virtual machine.

6. The method of claim 1, wherein the at least one network device comprises a host machine that is operable to execute at least one virtual machine, and

wherein receiving activity data comprises receiving activity data from a collector application that is operable to execute on the host machine and that is external to the at least one virtual machine.

7. The method of claim 6, wherein the at least one network device further comprises a virtual machine that is operable to execute on the host machine, and

wherein receiving activity data further comprises receiving activity data from a collector application that is operable to execute within the virtual machine.

8. The method of claim 1, wherein identifying the ones of the plurality of applications and relationships therebetween comprises correlating the received activity data with a predefined telecommunications standard.

9. The method of claim 8, wherein the predefined telecommunications standard includes a port numbers list maintained by Internet Assigned Numbers Authority.

10. The method of claim 1, wherein generating comprises dynamically generating a historical representation of the activities of the plurality of applications.

11. A system for generating a model of network application health, the method comprising:

a processing unit;

a memory having computer readable program code, which when executed by the processing unit cause the system to be operable to;

receive activity data that corresponds to activities of a plurality of applications that are operable to execute on at least one networked device;

combine received activity data by removing redundant portions thereof and by reconciling inconsistencies among data received from different ones of the plurality of collector applications therein, wherein after combining the received activity data, the received activity data includes the activity data from the plurality of collector applications without redundant portions thereof;

identify ones of the plurality of applications and relationships there between based on the received activity data;

generate a model including identified applications and relationships there between; and

display a representation of the model.

12. The system of claim 11, wherein the at least one networked device comprises a plurality of networked devices, and

wherein to receive activity data comprises receiving activity data from a plurality of collector applications that are operable to execute on respective ones of the plurality of networked devices.

13. The system of claim 11, wherein the system is further operable to:

infer the existence of a second application for which corresponding activity data was not received based on an identification of a first application for which corresponding activity data was received; and

infer the relationship between the first and the second applications based on the identification of the first application.

14. The method of claim 11, wherein the system is further operable to:

store received activity data and associated data that indicates when the activity data was received,

wherein to identify is based on stored activity data received during a specified time interval.

15. The method of claim 11, wherein the at least one network device comprises a virtual machine, and

wherein to receive activity data comprises receiving activity data from a collector application that is operable to execute within the virtual machine.

16. The method of claim 11, wherein the at least one network device comprises a host machine that is operable to execute at least one virtual machine, and

wherein to receive activity data comprises receiving activity data from a collector application that is operable to execute on the host machine and that is external to the at least one virtual machine.

17. The method of claim 16, wherein the at least one network device further comprises a virtual machine that is operable to execute on the host machine, and

wherein to receive activity data further comprises receiving activity data from a collector application that is operable to execute within the virtual machine.

18. The method of claim 11, wherein to identify the ones of the plurality of applications and relationships therebetween comprises correlating the received activity data with a predefined telecommunications standard.

19. The method of claim 18, wherein the predefined telecommunications standard includes a port numbers list maintained by Internet Assigned Numbers Authority.

20. A computer program product implemented in hardware, comprising:

a computer readable storage medium having computer readable program code embodied therein, the computer readable program code comprising;

computer readable program code configured to receive activity data that corresponds to activities of a plurality of applications that are operable to execute on at least one networked device;

computer readable program code configured to combine received activity data by removing redundant portions thereof and by reconciling inconsistencies among data received from different ones of the plurality of collector applications therein, wherein after combining the received activity data, the received activity data includes the activity data from the plurality of collector applications without redundant portions thereof;

computer readable program code configured to identify ones of the plurality of applications and relationships therebetween based on the received activity data;

computer readable program code configured to generate a model that includes identified applications and relationships therebetween; and

computer readable program code configured to display a representation of the model.