Network transaction discovery
View Patent ↗Disclosed herein is a computer implemented technique for discovering the information technology resources that are involved in a particular networked business transaction. The system comprises three basic components. A robotic transaction playback client records the various steps in a particular transaction and can repetitively execute these steps to analyze the results. A network record collector observes the traffic throughout the network in response to the repeated instances of the transaction executed by the robotic transaction playback client. A backend processor analyzes the observations of network traffic to determine which ones are possibly tied to the transaction, and from this information determine which network components are part of the transaction being analyzed. Event timing information from a plurality of executions of a particular transaction are used to determine resource usage and paths.
1. A computer network system for identifying resources used in a network transaction, the system comprising:
a plurality of computer systems communicatively coupled to a computer network;
wherein one or more of the plurality of computers systems comprises a programmable processor and the programmable processor is configured to execute:
a robotic transaction playback client configured to initiate re-execution of a recorded transaction;
a network record collector; and
a backend processor;
wherein the backend processor performs identification analysis by analyzing newly collected data, the newly collected data being collected by the network record collector in response to one or more transactions re-executed by the robotic transaction playback client to identify one or more resources used in the one or more transactions, the identification analysis comprising:
identifying a plurality of network paths potentially corresponding to the transaction;
assigning equal base probabilities to each of the plurality of network paths;
analyzing one or more additional parameters relating to network traffic observed on each of the plurality of network paths and flagging each of the plurality of network paths wherein the one or more additional parameters indicate a correlation with the transaction; and
assigning new probabilities to each of the plurality of network paths based on each of the re-executed transactions, wherein the new probability for each flagged path is increased and the new probability for each remaining path is decreased relative to the base probabilities.
2. The computer network system of claim 1 wherein the robotic transaction playback client is configured to replay the transaction at varying times.
3. The computer network system of claim 2 wherein the robotic transaction playback client is configured to replay the transaction under varying network traffic conditions.
4. The computer network system of claim 3 wherein the data collected by the network record collector includes one or more parameters selected from the group consisting of: originating network address, originating network port, destination network address, destination network port, message size, number of responses to a request, and a timestamp.
5. The computer network system of claim 1 wherein analyzing data collected by the network record collector in response to one or more transactions executed by the robotic transaction playback client to identify one or more resources used in the transaction comprises identifying a plurality of nodes belonging to a single logical group of nodes and identifying any of the plurality as a single node.
6. A computer network system for identifying network resources required by a transaction, the computer network system comprising:
a plurality of computers communicatively coupled to a computer network;
wherein one or more of the plurality of computers systems comprises a programmable processor and the programmable processor is configured to execute:
recording the components of the transaction;
initiating re-execution of the recorded transaction one or more times;
collecting one or more data sets from a plurality of network probes wherein each of the one or more data sets uniquely corresponds to one re-execution of the recorded transaction; and
analyzing the collected data sets to identify network resources required by the re-executed transaction wherein the analysis comprises:
identifying a plurality of network paths potentially corresponding to the transaction;
assigning equal base probabilities to each of the plurality of network paths;
analyzing one or more additional parameters relating to network traffic observed on each of the plurality of network paths and flagging each of the plurality of network paths wherein the one or more additional parameters indicate a correlation with the transaction; and
assigning new probabilities to each of the plurality of network paths based on each of the re-executed transactions, wherein the new probability for each flagged path is increased and the new probability for each remaining path is decreased relative to the base probabilities.
7. The computer network system of claim 6 wherein analyzing the collected data further comprises:
identifying a beginning time of the transaction by identifying the time of an initial request sent by a client executing the transaction;
identifying an ending time of the transaction by identifying the time of a response to the initial request; and
identifying a first resource involved in the transaction by identifying the destination of the initial request.
8. The computer network system of claim 7 wherein analyzing the collected data further comprises:
identifying one or more request/response pairs sent/received by the first resource between the beginning time of the transaction and the ending time of the transaction; and
identifying one or more potential additional resources potentially in the transaction by identifying the destination/source of each of the identified request/response pairs.
9. The computer network system of claim 8 further comprising recursively applying the steps of claim 8 to eliminate resources not involved in the transaction.
10. The computer network system of claim 8 wherein identifying one or more potential additional resources further comprises assigning a probability to each potential additional resource.
11. The computer network system of claim 10 wherein the probability is heuristically determined.
12. The computer network system of claim 6 wherein assigning new probabilities to each of the plurality of network paths further comprises:
for each flagged network path, increasing the base probability by a predetermined percentage of the base probability multiplied by the number of nodes by which an endpoint of the network path is removed from a client originating the transaction to generate an intermediate probability;
summing the intermediate probabilities for each flagged network path and the base probabilities for each non-flagged network path to obtain a new probability sum; and
assigning a new probability for each network path wherein, for each flagged network path, the new probability is the intermediate probability divided by the new probability sum, and wherein, for each non-flagged network path, the new probability is the base probability divided by the new probability sum.
13. The computer network system of claim 6 wherein analyzing the collected data sets to identify network resources required by the transaction comprises identifying a plurality of nodes belonging to a single logical group of nodes and thenceforth identifying any of the plurality of nodes as a single node.
14. A non-transitory machine readable medium, having embodied thereon instructions executable by one or more machines to cause the one or more machines to collectively:
record the components of the transaction;
initiate re-execution of the recorded transaction one or more times;
collect one or more data sets from a plurality of network probes wherein each of the one or more data sets uniquely corresponds to one re-execution of the recorded transaction; and
analyze the collected data sets to identify network resources required by the re-executed transaction wherein the analysis comprises:
identifying a plurality of network paths potentially corresponding to the transaction;
assigning equal base probabilities to each of the plurality of network paths;
analyzing one or more additional parameters relating to network traffic observed on each of the plurality of network paths and flagging each of the plurality of network paths wherein the one or more additional parameters indicate a correlation with the transaction; and
assigning new probabilities to each of the plurality of network paths based on each of the re-executed transactions, wherein the new probability for each flagged path is increased and the new probability for each remaining path is decreased relative to the base probabilities.
15. A non-transitory machine readable medium, having embodied thereon instructions executable by one or more machines to cause the one or more machines to collectively execute:
a robotic transaction playback client configured to initiate re-execution of a recorded transaction;
a network record collector; and
a backend processor;
wherein the backend processor performs identification analysis by analyzing newly collected data, the newly collected data being collected by the network record collector in response to one or more transactions re-executed by the robotic transaction playback client to identify one or more resources used in the one or more transactions, the identification analysis comprising:
identifying a plurality of network paths potentially corresponding to the transaction;
assigning equal base probabilities to each of the plurality of network paths;
analyzing one or more additional parameters relating to network traffic observed on each of the plurality of network paths and flagging each of the plurality of network paths wherein the one or more additional parameters indicate a correlation with the transaction; and
assigning new probabilities to each of the plurality of network paths based on each of the re-executed transactions, wherein the new probability for each flagged path is increased and the new probability for each remaining path is decreased relative to the base probabilities.