A system and method for auditing network applications captures transmissions during a user session between a client and a server. An auditor capture filter captures and stores each request from the client and each response by the server to each request in an auditor storage. An auditor analyzer may use the captured requests and the captured responses to visually recreate the user session to thereby analyze what transpired during the user session.
|
10. A hardware system for visually recreating a user session, which includes a request and a response to the request, in a computer environment including a client and a server comprising:
a communication link between the client and the server,
a memory,
an auditor capture filter capable of
capturing the request and a first environmental data associated with the computer environment and storing the request and the first environmental data in the memory;
capturing the response to the request environment and storing the request and the a second environmental data in the memory environment ; and
a display for visually recreating the user session based on the captured request and the captured response.
1. A method executing on a hardware computer system for visually recreating a user session in a computer environment including a client and a server, the method comprising the steps of:
receiving a request from the client at the server;
capturing at the server the request and first environmental data associated with the computer environment;
determining, by the server, a response to the request;
sending the response from the server to the client;
capturing at the server the response to the request and second environmental data associated with the computer environment; and
visually recreating at the server the user session based on the captured request and the captured response.
2. The method of
3. The method of
4. The method of
retrieving the request;
retrieving the response;
displaying the retrieved request and response on a dynamically generated screen based on the first and second environmental data.
5. The method of
analyzing the first and second environmental data; and
displaying the analyzed environmental data.
6. The method of
7. The method of
8. The method of
9. The method of
locating the user session;
retrieving the request;
retrieving the response; and
displaying the retrieved request and response on a dynamically generated screen.
11. The system of
12. The system of
13. The system of
14. The system of
a processor for analyzing the first and second environmental data; and
wherein the display is further able to display the analyzed environmental data.
0. 15. The system of
0. 16. The system of
0. 17. The system of
0. 18. The system of
0. 19. The system of
0. 20. The system of
0. 21. The system of
0. 22. The system of
0. 23. The system of
0. 24. The system of
0. 25. The system of
0. 26. The system of
0. 27. The system of
0. 28. The system of
0. 29. The system of
0. 30. The system of
0. 31. The system of
0. 32. The system of
0. 33. The system of
0. 34. The system of
0. 35. The system of
0. 36. The system of
0. 37. The system of
0. 38. The system of
0. 39. The system of
0. 40. The system of
0. 41. The system of
0. 42. The system of
0. 43. The system of
0. 44. The system of
0. 45. The system of
0. 46. The system of
0. 47. The system of
0. 48. The system of
0. 49. The system of
0. 50. The system of
0. 51. The system of
0. 52. The system of
0. 53. The system of
0. 54. The system of
0. 55. The system of
0. 56. The system of
0. 57. The system of
0. 58. The system of
0. 59. The system of
0. 60. The system of
0. 61. The system of
0. 62. The system of
0. 63. The system of
0. 64. The system of
0. 65. The system of
0. 66. The system of
0. 67. The system of
0. 68. The system of
0. 69. The system of
0. 70. The system of
0. 71. The system of
0. 72. The system of
0. 73. The system of
0. 74. The system of
0. 75. The system of
0. 76. The system of
0. 77. The system of
0. 78. The system of
0. 79. The system of
0. 80. The system of
0. 81. The system of
0. 82. The system of
0. 83. The system of
0. 84. The system of
0. 85. The system of
0. 86. The system of
0. 87. The system of
0. 88. The system of
0. 89. The system of
0. 90. The system of
0. 91. The system of
0. 92. The system of
0. 93. The system of
0. 94. The system of
0. 95. The system of
0. 96. The system of
0. 97. The system of
0. 98. The system of
0. 99. The system of
0. 100. The system of
0. 101. The system of
0. 102. The system of
0. 103. The system of
0. 104. The system of
0. 105. The system of
0. 106. The system of
0. 107. The system of
0. 108. The system of
0. 109. The system of
0. 110. The system of
0. 111. The system of
0. 112. The system of
0. 113. The system of
0. 114. The system of
0. 115. The system of
0. 116. The system of
0. 117. The system of
0. 118. The system of
0. 119. The system of
0. 120. The system of
0. 121. The system of
0. 122. The system of
0. 123. The system of
0. 124. The system of
0. 125. The system of
0. 126. The system of
0. 127. The system of
0. 128. The system of
0. 129. The system of
0. 130. The system of
|
|||||||||||||||||||||||||||
This application is related to issued U.S. Pat. No. 6,286,098, entitled “System and Method for Encrypting Audit Information in Network Applications,” by inventors Robert Wenig and Igor Tsyganskiy. This application is also related to issued European Patent 1097428 B1, entitled “System and Method for Auditing Network Applications,” by inventors Robert Wenig, Igor Tsyganskiy, and Kenneth Landry, filed on 10 Jul. 1999.
1. Field of the Invention
The present invention relates to a system and method for auditing network applications. More particularly, the present invention relates to a system and method for visually recreating a user session to analyze various aspects of the network application.
2. Discussion of the Related Art
In a network application, also referred to as a client/server application, a client requests information from a server. In response to each request, the server provides information to the client. A typical server may be responding to several hundred clients at one time, while the client may access several servers intermittently and over a very short period of time. As a result of the very dynamic nature of such applications, problems associated with the application are difficult to isolate, repeat, and/or diagnose. Furthermore, such problems are difficult to attribute to either the server or the client.
Another problem associated with network applications, particularly those dealing in electronic commerce (“e-commerce”), is that the precise behavior of the purchaser during the transaction is difficult to ascertain and even more difficult to evaluate or understand. For example, website developers may wish to understand how a particular buyer using an e-commerce application navigates through the website to purchase an item. Given the nature of conventional network applications, such understanding is difficult to obtain.
Still other problems exists with network applications, some of which are discussed in further detail below. A need exists for a system and method for auditing network applications that solves the problems described herein.
Accordingly, the present invention is directed to a system and method for auditing network applications. In particular, the present invention captures requests and responses sent between a client and a server during a particular user session of a network application. The present invention stores the requests and responses in an auditor storage. Subsequently, the present invention retrieves the requests and responses from the auditor storage to visually recreate the user session.
One of the features of the present invention is that an analyst is able to retrieve a particular user session from the auditor storage and step through a particular user session thereby viewing the user session as the client viewed the user session. This enables the analyst to understand the sequence of events that occurred during a particular user session exactly as they occurred.
Another feature of the present invention is that the analyst can determine the exact sequence of events that occurred prior to an error occurring in the network application. In addition, the present invention stores information describing the client/server environment during the user session so that the analyst may be able to attribute certain errors to loading or traffic on the server or the communication link.
Another feature of the present invention is that the analyst can view data associated with multiple user sessions to analyze how different clients navigated through a particular website. Such analysis is useful to determine how particular websites might be improved to achieve a particular result.
Another feature of the present invention is that OLAP analysis can be used, for example, to provide better response times to clients who routinely purchase by shifting them to a faster application server. Furthermore, clients who routinely purchase could also be offered a direct path to a particular location in the website thereby avoiding the path through the website provided to other clients. In addition, the analyst can ascertain the value of advertising on the website by viewing the number of purchases before and after such advertising.
Additional features and advantages of the present invention will be set forth in the description which follows, and in part will be apparent from the description, or may be learned by practice of the invention. The objectives and other advantages of the invention will be realized and attained by the process particularly pointed out in the written description and claims hereof as well as the appended drawings.
It is to be understood that both the foregoing general description and the following detailed description are exemplary and explanatory and are intended to provide further explanation of the invention as claimed.
The accompanying drawings, which are included to provide a further understanding of the invention and are incorporated in and constitute a part of this specification, illustrate embodiments of the invention that together with the description serve to explain the principles of the invention.
In the drawings:
Reference will now be made in detail to the preferred embodiments of the present invention, examples of which are illustrated in the accompanying drawings.
In a client/server environment 100, such as that illustrated in
A particular set of related communications between client 110 and server environment 140 is referred to as a user session 130. User session 130 includes a series of requests 134 made by client 110 to server environment 140, and a series of responses 132 from server environment 140 to client 110 in response to requests 134. A particular request 134 and its associated response 132 is referred to herein as a hit 135 or alternatively as a request/response pair. During user session 130, client 110 may access server environment 140 in any of several manners, as is known in the art.
Client 110 accesses server environment 140 through a dynamically generated screen 120 which displays information to client 110 from server environment 140 for a particular network application. Based on requests 134 and responses 132, server environment 140 provides information to update dynamically generated screen 120. According to one embodiment of the present invention, dynamically generated screen 120 is generated by a work station (not shown) of client 110 based on information included in response 132 from server environment 140. In one embodiment of the present invention, dynamically generated screen 120 is generated by the work station based on a response 132 that includes a markup language such as HTML, XML, SGML, etc., used in various client/server environments 100. In an alternate embodiment of the present invention, dynamically generated screen 120 is generated by a work station of client 110 based on a response 132 that includes information compatible with formats utilized in a dedicated on-line environment such as a SAP R/3 environment.
The following discussion is based on client/server environment 100 operating in an Internet or Web-based environment. However, it should be understood that the present invention also contemplates a system where client 110 is hard-wired directly to server environment 140, such as in the SAP R/3 environment. It will be apparent to one skilled in the art how the following discussion applies to such hardwired or “dedicated” systems.
According to the present invention, an auditor capture filter 150 monitors communication link 125 to capture communications (i.e., requests 134 and responses 132) between client 110 and server environment 140. In particular, auditor capture filter 150 captures request 134 from client 110 to server environment 140 and captures response 132 from server environment 140 to client 110. In one embodiment of the present invention, auditor capture filter 150 captures request 134 from communication link 125 after server environment 140 has received request 134 but before server environment 140 has processed request 134. In this embodiment of the present invention, auditor capture filter 150 captures response 132 after server environment 140 has processed request 134 and determined response 132 but prior to server environment 140 sending response 132. It should be understood that the capturing function of a preferred auditor capture filter 150 does not interfere with or interrupt communication between client 100 and server environment 140.
In the embodiment of the present invention just described, server environment 140 would include the necessary modifications to provide auditor capture filter 150 with access to requests 134 and responses 132. In other words, server environment 140 would provide auditor capture filter 150 with the necessary hooks to the session data as would be apparent. In this embodiment, auditor capture filter 150 captures requests 134 and responses 132 with the cooperation and possibly the active participation of server environment 140.
In an alternate embodiment of the present invention, auditor capture filter 150 would not require the modifications to server environment 140 discussed above. In this alternate embodiment of the present invention, auditor capture filter 150 would capture requests 134 and responses 132 directly from communication link 125 and server environment 140 would function without regard to the presence of auditor capture filter 150.
Auditor capture filter 150 stores captured request 134 and captured response 132 in an auditor storage 160. In a preferred embodiment of the present invention, captured request 134 and captured response 132 are stored as a hit 135. Auditor storage 160 includes a storage device such as a disk drive, a RAM, a database or other such memory device as would be apparent. In some preferred embodiments of the present invention, auditor storage 160 stores all hits 135 in a particular user session 130 as stored hits 175 in a stored user session 170. In other words, in these embodiments of the present invention, the series of captured requests 134 and captured responses 132 that comprise a particular user session 130 are stored collectively as stored user session 170.
In one embodiment of the present invention, user session 130 is conducted over an Internet. As such, after each transmission, (i.e., after each request 134 from client 110 to server environment 140 and after each response 132 from server environment 140 to client 10) client 110 and server environment 140 are not in active communication (i.e., they are effectively disconnected). In such an application, a unique session identification (also referred herein as a state identification) is used to identify a particular client 110 each time the particular client 110 accesses server environment 140. The session identification is sent with each request 134 to uniquely determine the user context. Using the session identification to attribute each request 134 to a particular client 110, server environment 140 is able to handle client 110 over the Internet as if client 110 was continuously connected to server environment 140.
In a second embodiment of the present invention, client 10 and server environment 140 are continuously connected via dedicated communication link 125. In this embodiment of the present invention, a session identification is not necessary for each request 134; rather, the session identification is implicit in each transmission between client 110 and server environment 140 as a result of the dedicated communication link 125.
As discussed above, a series of requests 134 and responses 132 between client 110 and server environment 140 that comprise user session 130 are stored in auditor storage 160 as stored hits 175 in stored user session 170. As discussed in reference to
In another example, analyst 210 may evaluate user session 170 to isolate errors that occurred during user session 130. In this example, analyst 210 can recreate the entire user session 130 in an effort to identify and isolate a problem with a particular network application.
As shown at
Having thus described the components of the present invention, the operation of the present invention is now discussed.
In an alternate embodiment of the present invention, auditor capture filter 150 captures request 134 directly from communication fink 125 without cooperation from or participation with server environment 140.
In a preferred embodiment of the present invention, capturing request 134 includes capturing or determining particular environmental data (not shown) associated with client 110 and server environment 140 at or about the time request 134 was sent or captured. This environmental data includes parameters such as loading, traffic volume, status, or other such information available on communication link 125 and well known in client/server environment 100. As will be discussed below, the environmental data permits analyzer 220 to evaluate the effect of client/server environment 100 on a particular user session 170.
In a step 330, server environment 140 determines a response 132 to request 134 from client 110. In a step 340, server environment 140 sends response 132 to client 110. In a step 350, according to one embodiment of the present invention, auditor capture filter 150 captures response 132 from server environment 140 to client 110. In an alternate embodiment, server environment 140 may pass response 132 to auditor capture filter 150 as would be apparent. In yet another alternate embodiment of the present invention, auditor capture filter 150 captures response 132 directly from communication link 125. Furthermore, as discussed above with respect to capturing request 134, in a preferred embodiment of the present invention, capturing response 132 includes capturing environmental data associated with response 132.
Finally, in a step 360, auditor capture filter 150 stores captured request 134 and captured response 132 as a hit 175 in auditor storage 160. In particular, each hit 175 (or alternately, each request/response pair) is stored in auditor storage 160 together with other hits associated with a particular user session 170.
In an alternate embodiment of the present invention, auditor capture filter 150 stores captured request 134 in auditor storage 160 as soon as it is captured rather than waiting for an associated captured response 132. In other words, captured request 134 and captured response 132 are stored as they are captured.
According to one embodiment of the present invention, auditor capture filter 150 captures or receives requests 134 and/or responses 132 from server environment 140. In fact, in actual implementation, auditor capture filter 150 may reside on and operate in conjunction with server environment 140. With this implementation and according to the present invention, software, hardware, or a combination of software and hardware associated with auditor capture filter 150 is not required at client 110 nor does client 110 require any modifications to the hardware or software residing therein.
In an alternate embodiment of the present invention, auditor capture filter 150 captures requests 134 and responses 132 directly from communication link. In this embodiment of the present invention, software, hardware, or a combination of software and hardware associated with auditor capture filter 150 is not required at either client 110 or server environment 140.
User session 170 may be located by any number of mechanisms as would be apparent. Such mechanisms may permit analyzer to access auditor storage 160 according to the date and/or session number which correspond to a particular user session 170 sought. However, such date and session number may not always be known. Hence, analyzer 220 may include other mechanisms for locating user session 170 such as searching auditor storage 160 using key words, identifiers, etc., or any other manner of searching auditor storage 160 as would be apparent to one skilled in the art.
After a particular user session 170 has been located, in a step 420, analyzer 220 retrieves request 134 from auditor storage 160. Likewise, in a step 430, analyzer 220 retrieves response 132 corresponding to request 134 from auditor storage 160. As discussed above, in an alternate embodiment of the present invention, analyzer 220 may retrieve request 134 and response 132 directly from auditor capture filter 150.
In a preferred embodiment of the present invention, when analyzer 220 retrieves request 134 and response 132, analyzer 220 also retrieves associated environmental data that may have been stored with each request 134 and response 132 as discussed above.
In a step 440, analyzer 220 uses the retrieved request and the retrieved response, and in the preferred embodiment, the retrieved environmental data associated with each, to recreate and display the dynamically generated screen 120. In this manner, analyzer 220 is able to present to analyst 210 a dynamically generated screen 120 that is the same as that viewed by client 110 during user session 130.
Analyzer 220 is now discussed in further detail in reference to FIG. 6. Analyzer 220 includes a analyze module 620, an analyzer database 630, and an import module 640. Import module 640 extracts meaningful information out of the raw data of user session 170 stored in auditor storage 160 for use by analyst 210. In a preferred embodiment of the present invention, import module 640 extracts information from hits 175 in user session 170 from auditor storage 160 and stores it in analyzer database 630 in a particular format unique to analyzer database 630. For example, for one application, import module 640 extracts information from hits 175 captured in an Internet environment, while for another application, import module 640 extracts information from hits 175 captured in an SAP R/3 environment. By doing so, import module 640 can extract session data associated with a variety of clients 110 and server environments 140 and combine it into one centralized, uniform database, such as analyzer database 630. Thus, subsequent analysis tools (such as analyze module 620) can analyze session data regardless of the format of captured hits 175. Furthermore, using the common format of analyzer database 630, the subsequent analysis tools can meaningfully compare session data obtained from different clients 110, server environments 140, applications, etc.
In a preferred embodiment of the present invention, data stored in analyzer database 630 includes pertinent data from request 132 and response 134, and the associated environmental data. This data includes information associated with and derived from client 110 and server environment 140 as well as the communication protocols used, and other relevant information that would be apparent to those familiar with various network protocols.
In a preferred embodiment of the present invention, analyzer database 630 includes two sets of tables for each application in client/server environment 100. The first tables are referred to as OLAP (“On-line Analysis Program”) analysis tables. The OLAP analysis tables are designed and optimized for preliminary OLAP analysis. In a preferred embodiment of the present invention, the OLAP analysis tables have a star-scheme structure and are fully indexed.
The second tables in database 1130 are referred to as session viewer/analysis tables. Session viewer/analysis tables are designed and optimized for visually recreating user session 130 and for doing session-specific analysis. Session viewer analysis tables include all of the hit information as well as information about the creation of available sessions and information extracted from the session identification.
In one embodiment of the present invention, import module 640 also stores information from auditor storage 160 into an archive (not shown). The archive is preferably a more permanent storage device. The information stored in the archive may be the raw data as it is stored in auditor storage 160, or it may be data from auditor storage 160 that is stripped of extraneous information not associated with the function or operation of analyzer 220. In either case, the information stored in archive is indexed according to the session identification number associated with each user session 130. Because each session identification is unique and non-reputable, the archive can store user sessions 170 from a variety of sources and a variety of applications without a risk of conflict resulting in the loss of data.
Analyze module 620 is now described in further detail with reference to FIG. 7. Analyze module 620 includes a global analysis module 710 and a viewer module 720. Viewer module 720 includes a specific analysis module 730, an intelligent parser 740, and a viewer component 750.
Global analysis module 710 allows analyst 210 to dynamically analyze user sessions 170 stored in analyzer database 720 from various clients 110, server environments 140, and various applications running in client/server environment 100. For example, global analysis module 710 permits analyst 210 to analyze user sessions 170 for all clients 110 that accessed a particular site in server environment 140. In another example, global analysis module 710 permits analyst 210 to analyze user sessions 170 for a particular client 110 that accessed multiple sites in different server environments 140. In yet another example, global analysis module 710 permits analyst 210 to analyze all user sessions 170 that resulted in a purchase of goods on a particular day for all clients 110 and all server environments 140. These are merely examples of how global analysis module 710 might access analyzer database 720 and are limited only by the information available in analyzer database 720 itself.
Viewer module 720 is responsible for visually recreating a particular user session 130, for performing session level analysis, and for presenting it to analyst 210. As mentioned above, viewer module 720 includes specific analysis component 730, intelligent parser module 740, and viewer component 750. Specific analysis component 730 is responsible for constantly providing statistical information associated with a particular dynamically generated screen 120 and the environmental data associated with that screen at the lime it was generated and/or displayed to client 110. In a preferred embodiment of the present invention, specific analysis component 730 also calculates congestion in client/server environment 100 on server environment 140 or on communication link 125 at the time the screen 120 was provided to client 110 by server environment 140.
Viewer component 750 is responsible for physically displaying user session 170. In particular, viewer component 750 provides analyst 210 with means to move through user session 170 as well as to display statistics provided by specific analysis component 720. In a preferred embodiment of the present invention, for each particular client/server application, a separate viewer component 750 exists. For HTML and XML, viewer component 750 is comprised of a web browser. For SAP R/3, viewer component 750 is comprised of a modified version of a front end used by SAP R/3. For other application, viewer component 750 comprises an appropriate .viewing program as would be apparent. In other words, a specific viewer component 750 is used depending on the particular client/server application.
Intelligent parser component 740 scans analyzer database 630 to determine if it includes HTML. If so, intelligent parser component 740 will determine if the HTML has any fields in it to allow intelligent parser component 740 to securely change the value of the fields upon a subsequent user request 134. In this manner, analyst 210 is able to view data entered by client 110 on the dynamically generated screen 120 as it occurred during user session 130. In a preferred embodiment of the present invention, intelligent parser component 740 does not implement this functionality for password fields for security reasons, as would be apparent.
As thus described, the present invention stores all requests 134 and responses 132 that occur between client 110 and server environment 140. However, this approach is not required and furthermore may not be desired, in all client/server environments 100. In alternate embodiments of the present invention, auditor capture filter 150 may only store requests 134 and responses 132 into auditor storage 160 when a significant event occurs. For example, in one embodiment of the present invention, requests 134 and responses 132 are stored in auditor storage 160 only if a purchase was completed. In this example, the purchase is a significant event. In another embodiment of the present invention, significant events may be further broken down. For example, one set of session data is stored for clients 110 that purchase $10 million or more worth of goods, while another set of session data is stored for clients 110 that purchase less than $10 million worth of goods. This embodiment of the present invention eliminates much of the data from auditor storage 160 associated with “surfing” or “browsing” or other insignificant events that might otherwise be stored. However, as would be apparent, in other embodiments of the present invention, such “surfing” or “browsing” data may be useful to determine usage patterns (i.e. shopping patterns) and should be stored in auditor storage 160. The specific significant events that trigger the storage of session data in auditor storage 160 can vary from application to application, as would be apparent.
In the embodiments of the present invention that use such significant events as a criteria for storing session data, requests 134 and responses 132 are preferably stored in a temporary memory until the particular significant event occurs. Once the significant event occurs, requests 134 and responses 132 would be transferred from the temporary memory into auditor storage 160. This process of transferring requests 134 and responses 132 from temporary memory into auditor storage 160 is referred to as “committing” requests 134 and responses 132 to auditor storage 160. Other mechanisms for committing the session data (i.e., requests 134 and responses 132) to auditor storage 160 are available as would be apparent. For example, session data could be stored in auditor 160 prior to the significant event and would be marked or otherwise indicated as being temporary or uncommitted. Once the significant event occurs, this data would be marked as committed. If the significant event does not occur, this data would be subsequently deleted or erased.
With this in mind, the operation of storing step 360 according to this embodiment of the present invention is now described with reference to FIG. 19. In a step 810, auditor capture filter 150 stores a request/response pair in a temporary database or other temporary memory. In a decision step 820, auditor capture filter 150 determines whether a significant event occurred. If the significant event occurred, in a step 830, auditor capture filter 150 commits the request/response pairs stored in the temporary database or temporary memory to auditor storage 160. At some point, if the temporary database or temporary memory was not committed, auditor capture filter 150 would delete such temporary database or temporary memory.
While the invention has been described in detail and with reference to specific embodiments thereof, it will be apparent to one skilled in the art that various changes and modifications can be made therein without departing from the spirit and scope thereof. Thus, it is intended that the present invention cover the modifications and variations of this invention provided they come within the scope of the appended claims and their equivalents.
Tsyganskiy, Igor, Wenig, Robert, Landry, Kenneth
| Patent | Priority | Assignee | Title |
| 10003671, | Oct 15 2012 | ACOUSTIC, L P | Capturing and replaying application sessions using resource files |
| 10032134, | Oct 02 2014 | SAP SE | Automated decision making |
| 10127273, | Apr 15 2014 | SPLUNK Inc. | Distributed processing of network data using remote capture agents |
| 10193916, | Oct 30 2014 | SPLUNK Inc. | Configuring the generation of event data based on a triggering search query |
| 10257059, | Apr 15 2014 | SPLUNK Inc. | Transforming event data using remote capture agents and transformation servers |
| 10264106, | Oct 30 2014 | SPLUNK Inc. | Configuring generation of multiple event streams from a packet flow |
| 10334085, | Jan 29 2015 | SPLUNK Inc.; SPLUNK INC | Facilitating custom content extraction from network packets |
| 10348583, | Apr 15 2014 | SPLUNK Inc. | Generating and transforming timestamped event data at a remote capture agent |
| 10360196, | Apr 15 2014 | SPLUNK Inc.; SPLUNK INC | Grouping and managing event streams generated from captured network data |
| 10366101, | Apr 15 2014 | SPLUNK Inc.; SPLUNK INC | Bidirectional linking of ephemeral event streams to creators of the ephemeral event streams |
| 10374883, | Apr 15 2014 | SPLUNK Inc. | Application-based configuration of network data capture by remote capture agents |
| 10382599, | Oct 30 2014 | SPLUNK Inc. | Configuring generation of event streams by remote capture agents |
| 10462004, | Apr 15 2014 | SPLUNK Inc.; SPLUNK INC | Visualizations of statistics associated with captured network data |
| 10474735, | Nov 19 2012 | ACOUSTIC, L P | Dynamic zooming of content with overlays |
| 10474840, | Oct 23 2012 | ACOUSTIC, L P | Method and apparatus for generating privacy profiles |
| 10521486, | Mar 31 2009 | ACOUSTIC, L P | Method and apparatus for using proxies to interact with webpage analytics |
| 10523521, | Apr 15 2014 | SPLUNK Inc.; SPLUNK INC | Managing ephemeral event streams generated from captured network data |
| 10523784, | Oct 15 2012 | ACOUSTIC, L P | Capturing and replaying application sessions using resource files |
| 10693742, | Apr 15 2014 | SPLUNK Inc.; SPLUNK INC | Inline visualizations of metrics related to captured network data |
| 10700950, | Apr 15 2014 | SPLUNK Inc.; SPLUNK INC | Adjusting network data storage based on event stream statistics |
| 10701191, | Oct 30 2014 | SPLUNK Inc. | Configuring rules for filtering events to be included in event streams |
| 10805438, | Oct 30 2014 | SPLUNK Inc. | Configuring the protocol-based generation of event streams by remote capture agents |
| 10812514, | Oct 30 2014 | SPLUNK Inc. | Configuring the generation of additional time-series event data by remote capture agents |
| 10951474, | Apr 15 2014 | SPLUNK Inc. | Configuring event stream generation in cloud-based computing environments |
| 11086897, | Apr 15 2014 | SPLUNK Inc. | Linking event streams across applications of a data intake and query system |
| 11108659, | Apr 15 2014 | SPLUNK Inc. | Using storage reactors to transform event data generated by remote capture agents |
| 11115505, | Jan 29 2015 | SPLUNK Inc. | Facilitating custom content extraction rule configuration for remote capture agents |
| 11245581, | Apr 15 2014 | SPLUNK Inc. | Selective event stream data storage based on historical stream data |
| 11252056, | Apr 15 2014 | SPLUNK Inc. | Transforming event data generated by remote capture agents using user-generated code |
| 11281643, | Apr 15 2014 | SPLUNK Inc. | Generating event streams including aggregated values from monitored network data |
| 11296951, | Apr 15 2014 | SPLUNK Inc. | Interval-based generation of event streams by remote capture agents |
| 11314737, | Apr 15 2014 | SPLUNK Inc. | Transforming event data using values obtained by querying a data source |
| 11425229, | Oct 30 2014 | SPLUNK Inc. | Generating event streams from encrypted network traffic monitored by remote capture agents |
| 11451453, | Apr 15 2014 | SPLUNK Inc. | Configuring the generation of ephemeral event streams by remote capture agents |
| 11716248, | Apr 15 2014 | SPLUNK Inc. | Selective event stream data storage based on network traffic volume |
| 11818018, | Apr 15 2014 | SPLUNK Inc. | Configuring event streams based on identified security risks |
| 11863408, | Apr 15 2014 | SPLUNK Inc. | Generating event streams including modified network data monitored by remote capture agents |
| 11936764, | Oct 30 2014 | SPLUNK Inc. | Generating event streams based on application-layer events captured by remote capture agents |
| 11973852, | Jan 29 2015 | SPLUNK Inc. | Generating event data at remote capture agents based on identified network addresses |
| 7970722, | Nov 08 1999 | International Business Machines Corporation | System, method and computer program product for a collaborative decision platform |
| 8005777, | Nov 08 1999 | International Business Machines Corporation | System, method and computer program product for a collaborative decision platform |
| 8042055, | Aug 31 2007 | ACOUSTIC, L P | Replaying captured network interactions |
| 8127000, | Jun 30 2006 | ACOUSTIC, L P | Method and apparatus for monitoring and synchronizing user interface events with network data |
| 8160988, | Nov 08 1999 | International Business Machines Corporation | System, method and computer program product for a collaborative decision platform |
| 8335848, | Jun 30 2006 | ACOUSTIC, L P | Method and apparatus for monitoring and synchronizing user interface events with network data |
| 8533532, | Jun 23 2010 | ACOUSTIC, L P | System identifying and inferring web session events |
| 8583772, | Aug 14 2008 | ACOUSTIC, L P | Dynamically configurable session agent |
| 8868533, | Jun 30 2006 | ACOUSTIC, L P | Method and apparatus for intelligent capture of document object model events |
| 8898275, | Aug 14 2008 | ACOUSTIC, L P | Dynamically configurable session agent |
| 8914736, | Mar 30 2010 | ACOUSTIC, L P | On-page manipulation and real-time replacement of content |
| 8930818, | Mar 31 2009 | ACOUSTIC, L P | Visualization of website analytics |
| 8949406, | Aug 14 2008 | ACOUSTIC, L P | Method and system for communication between a client system and a server system |
| 8990714, | Aug 31 2007 | ACOUSTIC, L P | Replaying captured network interactions |
| 9207955, | Aug 14 2008 | ACOUSTIC, L P | Dynamically configurable session agent |
| 9495340, | Jun 30 2006 | ACOUSTIC, L P | Method and apparatus for intelligent capture of document object model events |
| 9535720, | Nov 13 2012 | ACOUSTIC, L P | System for capturing and replaying screen gestures |
| 9536108, | Oct 23 2012 | ACOUSTIC, L P | Method and apparatus for generating privacy profiles |
| 9596253, | Oct 30 2014 | SPLUNK Inc.; SPLUNK INC | Capture triggers for capturing network data |
| 9635094, | Oct 15 2012 | ACOUSTIC, L P | Capturing and replaying application sessions using resource files |
| 9762443, | Apr 15 2014 | SPLUNK Inc. | Transformation of network data at remote capture agents |
| 9787803, | Aug 14 2008 | ACOUSTIC, L P | Dynamically configurable session agent |
| 9838512, | Oct 30 2014 | SPLUNK Inc. | Protocol-based capture of network data using remote capture agents |
| 9842093, | Jun 30 2006 | ACOUSTIC, L P | Method and apparatus for intelligent capture of document object model events |
| 9843598, | Oct 30 2014 | SPLUNK Inc. | Capture triggers for capturing network data |
| 9923767, | Apr 15 2014 | SPLUNK Inc. | Dynamic configuration of remote capture agents for network data capture |
| 9934320, | Mar 31 2009 | ACOUSTIC, L P | Method and apparatus for using proxy objects on webpage overlays to provide alternative webpage actions |
| ER3590, |
| Patent | Priority | Assignee | Title |
| 5463547, | Apr 19 1990 | New York Mercantile Exchange | Portable trade recordation system including means for abbreviated entry of data |
| 5577254, | Jun 29 1993 | Bull HN Information Systems Inc.; BULL HN INFORMATION SYSTEMS INC | Method and apparatus for capturing the presentation of an interactive user session, monitoring, replaying and joining sessions |
| 5715314, | Oct 24 1994 | Soverain Software LLC | Network sales system |
| 5809250, | Oct 23 1996 | Intel Corporation | Methods for creating and sharing replayable modules representive of Web browsing session |
| 5825880, | Jan 13 1994 | CERTCO, INC , A CORPORATION OF DELAWARE | Multi-step digital signature method and system |
| 5832458, | Jun 07 1995 | HEWLETT-PACKARD DEVELOPMENT COMPANY, L P | System and method for electronically auditing point-of-sale transactions |
| 5848396, | Apr 26 1996 | Conversant, LLC | Method and apparatus for determining behavioral profile of a computer user |
| 5867578, | Jun 05 1995 | CERTCO, INC , A CORPORATION OF DELAWARE | Adaptive multi-step digital signature system and method of operation thereof |
| 5903652, | Nov 25 1996 | Microsoft Technology Licensing, LLC | System and apparatus for monitoring secure information in a computer network |
| 5909492, | Oct 24 1994 | Wilmington Trust, National Association, as Administrative Agent | Network sales system |
| 5951643, | Oct 06 1997 | NCR Voyix Corporation | Mechanism for dependably organizing and managing information for web synchronization and tracking among multiple browsers |
| 6151601, | Nov 12 1997 | NCR Voyix Corporation | Computer architecture and method for collecting, analyzing and/or transforming internet and/or electronic commerce data for storage into a data storage area |
| 6286098, | Aug 28 1998 | International Business Machines Corporation | System and method for encrypting audit information in network applications |
| 6714931, | Apr 29 1998 | NCR Voyix Corporation | Method and apparatus for forming user sessions and presenting internet data according to the user sessions |
| 7272639, | Jun 07 1995 | Soverain IP, LLC | Internet server access control and monitoring systems |
| EP32683, | |||
| EP1097428, | |||
| GB326283, | |||
| WO13371, | |||
| WO843449, | |||
| WO9825372, | |||
| WO9826571, | |||
| WO9836520, | |||
| WO9826571, |
| Executed on | Assignor | Assignee | Conveyance | Frame | Reel | Doc |
| Oct 07 2005 | SAP AG | (assignment on the face of the patent) | / | |||
| Jul 07 2014 | SAP AG | SAP SE | CHANGE OF NAME SEE DOCUMENT FOR DETAILS | 033625 | /0334 | |
| Jun 15 2015 | SAP SE | International Business Machines Corporation | ASSIGNMENT OF ASSIGNORS INTEREST SEE DOCUMENT FOR DETAILS | 035897 | /0929 |
| Date | Maintenance Fee Events |
| Oct 24 2011 | ASPN: Payor Number Assigned. |
| Feb 27 2013 | M1553: Payment of Maintenance Fee, 12th Year, Large Entity. |
| Date | Maintenance Schedule |
| Oct 26 2013 | 4 years fee payment window open |
| Apr 26 2014 | 6 months grace period start (w surcharge) |
| Oct 26 2014 | patent expiry (for year 4) |
| Oct 26 2016 | 2 years to revive unintentionally abandoned end. (for year 4) |
| Oct 26 2017 | 8 years fee payment window open |
| Apr 26 2018 | 6 months grace period start (w surcharge) |
| Oct 26 2018 | patent expiry (for year 8) |
| Oct 26 2020 | 2 years to revive unintentionally abandoned end. (for year 8) |
| Oct 26 2021 | 12 years fee payment window open |
| Apr 26 2022 | 6 months grace period start (w surcharge) |
| Oct 26 2022 | patent expiry (for year 12) |
| Oct 26 2024 | 2 years to revive unintentionally abandoned end. (for year 12) |