Knowledge-based system and method for reconstructing client web page accesses from captured network packets

1. A method for reconstructing client web page accesses, said method comprising:

capturing network-level information for client accesses of at least one web page;

constructing a knowledge base of reliable information identifying content of at least one web page; and

reconstructing at least one client web page access from said captured network-level information using said reliable information of said knowledge base.

2. The method of claim 1 wherein said constructing a knowledge base comprises:

identifying at least one transaction for which the captured network-level information comprises information directly identifying its corresponding web page; and

associating the content of said at least one identified transaction to its corresponding web page.

3. The method of claim 1 wherein said constructing a knowledge base comprises:

using the captured network-level information to construct said knowledge base.

4. The method of claim 1 wherein said reconstructing at least one client web page access comprises:

relating transactions between a client and a server to their corresponding web page access.

5. The method of claim 1 wherein said reconstructing at least one client web page access further comprises:

identifying transactions for said client accesses from the captured network-level information; and

relating said transactions to their corresponding web page access.

6. The method of claim 1 wherein said network-level information comprises network packets.

7. The method of claim 1 wherein said capturing network-level information comprises:

using a network-level information capture tool for capturing said network-level information, said network-level information capture tool comprising one selected from the group consisting of tcpdump and WinDump.

8. The method of claim 1 further comprising:

performing said capturing network-level information on a server-side of a communication network used by a client to access said at least one web page.

9. The method of claim 1 wherein said capturing network-level information comprises:

capturing said network-level information for a plurality of transactions.

10. The method of claim 9 wherein each of said plurality of transactions comprises a request from a client to a server and a response to said client from said server.

11. The method of claim 9 wherein said reconstructing at least one client web page access comprises:

determining a respective web page access to which each of said plurality of transactions corresponds.

12. The method of claim 9 wherein said reconstructing at least one client web page access comprises at least one selected from the group consisting of:

using content information included in said captured network-level information for a transaction that identifies the type of content of the transaction to determine a client web page access to which the transaction corresponds, using information in said knowledge base to identify a web page to which the content of the transaction corresponds to determine a client web page access to which the transaction corresponds, and using information included in said captured network-level information for a transaction that directly identifies a web page to which the content of the transaction corresponds to determine a client web page access to which the transaction corresponds.

13. The method of claim 1 wherein said reconstructing at least one client web page access comprises:

if, from the captured network-level information for a given transaction between a client and a server, a particular web page can be determined to which content of the given transaction corresponds, then relating the given transaction to a client access of said particular web page; and

if the particular web page to which content of the given transaction corresponds cannot be determined from the captured network-level information for the given transaction, then determining whether the knowledge base comprises information identifying the particular web page to which content of the given transaction corresponds.

14. A method for constructing a knowledge base of information about the content of web pages accessed by clients, said method comprising:

capturing network-level information for client accesses of at least one web page;

identifying transactions for said client accesses from the captured network-level information;

determining at least one of said transactions that includes information directly identifying the web page to which said at least one transaction relates; and

constructing a knowledge base of information about the content of said at least one web page using at least said at least one transaction determined to include information directly identifying the web page to which it relates.

15. The method of claim 14 wherein said knowledge base comprises information associating the content of said at least one transaction that includes information directly identifying the web page to which it relates to its corresponding web page.

16. The method of claim 14 wherein said information directly identifying the web page to which said at least one transaction relates comprises:

the captured network-level information for said at least one transaction.

17. The method of claim 14 wherein said network-level information comprises network packets.

18. The method of claim 14 further comprising:

performing said capturing network-level information on a server-side of a communication network used by a client to access said at least one web page.

19. The method of claim 14 wherein said capturing network-level information comprises:

capturing said network-level information for a plurality of transactions.

20. The method of claim 19 wherein each of said plurality of transactions comprises a request from a client to a server and a response to said client from said server.

21. The method of claim 14 wherein said constructing a knowledge base of information further comprises:

using the content type of a given transaction to determine the web page to which the content of the given transaction corresponds.

22. A system for reconstructing client web page accesses, said system comprising:

means for capturing network-level information for a plurality of transactions for client accesses of at least one web page;

means for constructing a knowledge base of reliable information identifying content of at least one web page; and

means for reconstructing at least one client web page access by relating said plurality of transactions to their corresponding web page accesses.

23. The system of claim 22 wherein said means for constructing a knowledge base comprises:

means for identifying at least one of said plurality of transactions for which the captured network-level information comprises information directly identifying its corresponding web page.

24. The system of claim 22 wherein said means for constructing a knowledge base uses the captured network-level information to construct said knowledge base.

25. The system of claim 22 wherein said network-level information comprises network packets.

26. The system of claim 22 wherein said means for capturing network-level information is arranged on a server-side of a communication network used by a client to access said at least one web page.

27. The system of claim 22 wherein each of said plurality of transactions comprises a request from a client to a server and a response to said client from said server.

28. A method for reconstructing client information accesses, said method comprising:

capturing network-level information for client accesses of server information from a server, wherein each client access of said server information comprises a plurality of transactions;

using the captured network-level information for at least one of said plurality of transactions for constructing a knowledge base of reliable information identifying content of said server information; and

using said knowledge base for relating said plurality of transactions to their corresponding client access of said server information.

29. The method of claim 28 wherein said network-level information comprises network packets captured from a packet-switched communication network communicatively coupling a client and said server.

30. The method of claim 28 wherein each of said plurality of transactions comprises a request from a client to said server and a response from said server to said client.

31. The method of claim 28 wherein said relating said plurality of transactions to their corresponding client access of said server information comprises:

evaluating the captured network-level information for each of said plurality of transactions to determine the corresponding client access to which the transaction corresponds.

32. The method of claim 28 wherein said server information comprises a web page.

33. The method of claim 28 wherein said capturing network-level information is performed on a server-side of a client-server network.

34. The method of claim 28 wherein said constructing a knowledge base comprises:

determining at least one of said plurality of transactions that includes network-level information directly identifying the server information to which said at least one transaction relates; and

constructing a knowledge base about the content of said server information using said at least one transaction determined to include network-level information directly identifying the server information to which it relates.