Web transaction analysis
View Patent ↗Individual network activities are correlated to interactions with a target web page to facilitate an analysis of the performance of the web page. This correlation is preferably performed using a combination of heuristics and rules developed to filter network activities into those activities that are likely to have been caused by the particular transaction, and those that are unlikely to be associated with that transaction. The activities that are identified as being associated with the transaction are subsequently organized to identify a time-flow of these activities within the transaction, from which performance statistics can be determined and presented to a user. Because the individual activities within the transaction are identified and time-ordered, an analysis of the effects of each activity on the overall performance of the web page can be performed to identify potential problem areas, or to diagnose reported problems.
1. A method comprising:
collecting, via one or more network monitors, a plurality of traffic streams, each traffic stream including messages between elements other than the network monitors,
parsing the messages of each traffic stream into a plurality of HTTP objects,
identifying a page object in the plurality of HTTP objects,
identifying one or more page elements in the plurality of HTTP objects that are associated with the page object,
determining performance parameters associated with the page object based on characteristics of the one or more page elements, and
providing a display based on the performance parameters;
wherein identifying the one or more page elements includes assessing the plurality of HTTP objects based on a set of heuristics pertaining to attributes of the HTTP objects.
2. The method of claim 1 , wherein at least one heuristic is based on an HTTP referrer field in the HTTP object.
3. The method of claim 1 , wherein at least one heuristic is based on an HTTP location field in the HTTP object.
4. The method of claim 1 , wherein at least one heuristic is based on a time associated with the HTTP object.
5. The method of claim 1 , wherein at least one heuristic is based on an HTTP user agent field in the HTTP object.
6. The method of claim 1 , wherein at least one heuristic is based on one or more address fields associated with the HTTP object.
7. The method of claim 1 , wherein at least one heuristic is based on one or more cookies in the HTTP object.
8. The method of claim 1 , wherein identifying the page object is based on a content type in the HTTP object.
9. The method of claim 1 , wherein identifying the one or more page elements includes using one or more decision trees that control a sequence of assessments based on the set of heuristics.
10. The method of claim 9 , including detecting an anomaly in the traffic streams and modifying the decision tree based on the anomaly.
11. The method of claim 9 , wherein each heuristic includes a priority and the decision tree is structured based on the priorities of the heuristics.
12. The method of claim 11 , including detecting an anomaly in the traffic streams and modifying the priorities based on the anomaly.
13. The method of claim 1 , wherein the parsing of one or more of the traffic streams includes decrypting content of the traffic stream, and the presenting of the display in includes preventing display of some or all of the decrypted content.
14. A system comprising:
one or more network monitors that is configured to capture a plurality of traffic streams, each traffic stream including messages between elements other than the network monitors,
a transaction identifier that is configured to:
parse the messages of each traffic stream into a plurality of HTTP objects, and
identify a page object in the plurality of HTTP objects,
a page stitcher that is configured to identify one or more page elements in the plurality of HTTP objects that are associated with the page object,
a performance analyzer that is configured to determine performance parameters associated with the page object based on characteristics of the one or more page elements, and
a user interface that is configured to provide a display based on the performance parameters;
wherein identifying the one or more page elements includes assessing the plurality of HTTP objects based on a set of heuristics pertaining to attributes of the HTTP objects.
15. The system of claim 14 , wherein at least one heuristic is based on an HTTP referrer field in the HTTP object.
16. The system of claim 14 , wherein at least one heuristic is based on an HTTP location field in the HTTP object.
17. The system of claim 14 , wherein at least one heuristic is based on a time associated with the HTTP object.
18. The system of claim 14 , wherein at least one heuristic is based on an HTTP user agent field in the HTTP object.
19. The system of claim 14 , wherein at least one heuristic is based on one or more address fields associated with the HTTP object.
20. The system of claim 14 , wherein at least one heuristic is based on one or more cookies in the HTTP object.
21. The system of claim 14 , wherein identifying the page object is based on a content type in the HTTP object.
22. The system of claim 14 , wherein identifying the one or more page elements includes using one or more decision trees that control a sequence of assessments based on the set of heuristics.
23. The system of claim 22 , wherein the page stitcher is configured to detect an anomaly in the traffic streams and modifying the decision tree based on the anomaly.
24. The system of claim 22 , wherein each heuristic includes a priority and the decision tree is structured based on the priorities of the heuristics.
25. The system of claim 24 , including detecting an anomaly in the traffic streams and modifying the priorities based on the anomaly.
26. The system of claim 14 , wherein the parsing of one or more of the traffic streams includes decrypting content of the traffic stream, and the presenting of the display in includes preventing display of some or all of the decrypted content.
27. A non-transitory computer-readable medium that includes a program that, when executed by a processor, causes the processor to:
capture, via one or more network monitors, a plurality of traffic streams, each traffic stream including messages between elements other than the network monitors,
parse the messages of each traffic stream into a plurality of HTTP objects, and
identify a page object in the plurality of HTTP objects,
identify one or more page elements in the plurality of HTTP objects that are associated with the page object,
determine performance parameters associated with the page object based on characteristics of the one or more page elements, and
provide a display based on the performance parameters;
wherein the program causes the processor to identify the one or more page elements by assessing the plurality of HTTP objects based on a set of heuristics pertaining to attributes of the HTTP objects.
28. The medium of claim 27 , wherein at least one heuristic is based on an HTTP referrer field in the HTTP object.
29. The medium of claim 27 , wherein at least one heuristic is based on an HTTP location field in the HTTP object.
30. The medium of claim 27 , wherein at least one heuristic is based on a time associated with the HTTP object.
31. The medium of claim 27 , wherein at least one heuristic is based on an HTTP user agent field in the HTTP object.
32. The medium of claim 27 , wherein at least one heuristic is based on one or more address fields associated with the HTTP object.
33. The medium of claim 27 , wherein at least one heuristic is based on one or more cookies in the HTTP object.
34. The medium of claim 27 , wherein identifying the page object is based on a content type in the HTTP object.
35. The medium of claim 27 , wherein the program causes the processor to identify the one or more page elements by using one or more decision trees that control a sequence of assessments based on the set of heuristics.
36. The medium of claim 35 , wherein the program enables the processor to detect an anomaly in the traffic streams and modify the decision tree based on the anomaly.
37. The medium of claim 35 , wherein each heuristic includes a priority and the decision tree is structured based on the priorities of the heuristics.
38. The medium of claim 37 , wherein the program enables the processor to identify anomaly in the traffic streams and modify the priorities based on the anomaly.
39. The medium of claim 27 , wherein the program causes the processor to parse one or more of the traffic streams by decrypting content of the traffic stream, and prevent display of some or all of the decrypted content.