System and method for telemetry data based event occurrence analysis with rule engine
Embodiments determine event, e.g., performance degradation, security breach, etc., occurrence based on telemetry data. An embodiment receives telemetry data, e.g., data based on an HTTP transaction, and a rule associated with the telemetry data. The rule defines one or more filters for processing the telemetry data. In turn, a rule engine is modified in accordance with the received rule. The received telemetry data is processed with the modified rule engine to determine event occurrence.
1. A computer-implemented method for determining event occurrence based on telemetry data, the method comprising:
receiving telemetry data, an indication of a rule for processing the received telemetry data, and the rule, the received rule defining one or more filters for the processing;
modifying a rule engine in accordance with the received rule by defining runtime state functionality of a finite state automaton, implemented by the rule engine, in accordance with the received rule; and
processing the received telemetry data with the modified rule engine to determine event occurrence.
2. The method of claim 1 wherein the telemetry data is based on at least one of: a Hypertext Transfer Protocol (HTTP) transaction and processing the HTTP transaction.
3. The method of claim 1 wherein the telemetry data is based on multiple HTTP transactions.
4. The method of claim 1 wherein the rule is constructed and defined in accordance with a grammar.
5. The method of claim 1 wherein the processing comprises:
identifying which of the one or more filters are activated in processing the received telemetry data; and
determining event occurrence based on the identified activated filters.
6. The method of claim 1 wherein the rule further defines at least one of:
output of a first filter utilized by a second filter;
an event profile comprising a group of filters or sequence of filters;
a feature comprising one or more event profiles; and
a namespace comprising one or more features.
7. The method of claim 6 wherein:
modifying the rule engine in accordance with the received rule comprises modifying the rule engine in accordance with the event profile; and
processing the received telemetry data with the rule engine modified in accordance with the event profile comprises determining event occurrence if the one or more filters are activated in accordance with the event profile.
8. The method of claim 6 wherein:
modifying the rule engine in accordance with the received rule comprises modifying the rule engine in accordance with the namespace and an event profile associated with the namespace; and
processing the received telemetry data with the rule engine modified in accordance with the namespace and the event profile associated with the namespace comprises determining event occurrence if the one or more filters are activated in accordance with the event profile associated with the namespace.
9. The method of claim 1 wherein the event is:
a performance degradation;
a security breach;
a hijacked session; or
a behavior defined by the rule.
10. The method of claim 1 wherein the processing determines event occurrence in real-time.
11. A system for determining event occurrence based on telemetry data, the system comprising:
a processor; and
a memory with computer code instructions stored thereon, the processor and the memory, with the computer code instructions, being configured to cause the system to:
receive telemetry data, an indication of a rule for processing the received telemetry data, and the rule, the received rule defining one or more filters for the processing;
modify a rule engine in accordance with the received rule by defining runtime state functionality of a finite state automaton, implemented by the rule engine, in accordance with the received rule; and
process the received telemetry data with the modified rule engine to determine event occurrence.
12. The system of claim 11 wherein the telemetry data is based on at least one of: a Hypertext Transfer Protocol (HTTP) transaction and processing the HTTP transaction.
13. The system of claim 11 wherein the rule is constructed and defined in accordance with a grammar.
14. The system of claim 11 wherein to process the received telemetry data with the modified rule engine, the processor and the memory, with the computer code instructions, are further configured to cause the system to:
identify which of the one or more filters are activated in processing the received telemetry data; and
determine event occurrence based on the identified activated filters.
15. The system of claim 11 wherein the rule further defines at least one of:
output of a first filter utilized by a second filter;
an event profile comprising a group of filters or sequence of filters;
a feature comprising one or more event profiles; and
a namespace comprising one or more features.
16. The system of claim 15 wherein:
to modify the rule engine in accordance with the received rule, the processor and the memory, with the computer code instructions, are further configured to cause the system to modify the rule engine in accordance with the event profile; and
to process the received telemetry data with the rule engine modified in accordance with the event profile, the processor and the memory, with the computer code instructions, are further configured to cause the system to determine event occurrence if the one or more filters are activated in accordance with the event profile.
17. The system of claim 15 wherein:
to modify the rule engine in accordance with the received rule, the processor and the memory, with the computer code instructions, are further configured to cause the system to modify the rule engine in accordance with the namespace and an event profile associated with the namespace; and
to process the received telemetry data with the rule engine modified in accordance with the namespace and the event profile associated with the namespace, the processor and the memory, with the computer code instructions, are further configured to cause the system to determine event occurrence if the one or more filters are activated in accordance with the event profile associated with the namespace.
18. A non-transitory computer program product for determining event occurrence, the computer program product executed by a server in communication across a network with one or more clients and comprising:
a computer readable medium, the computer readable medium comprising program instructions, which, when executed by a processor, causes the processor to:
receive telemetry data, an indication of a rule for processing the received telemetry data, and the rule, the received rule defining one or more filters for the processing;
modify a rule engine in accordance with the received rule by defining runtime state functionality of a finite state automaton, implemented by the rule engine, in accordance with the received rule; and
process the received telemetry data with the modified rule engine to determine event occurrence.