Method and system for real-time, false positive resistant, load independent and self-learning anomaly detection of measured transaction execution parameters like response times

    公开(公告)号:US09817884B2

    公开(公告)日:2017-11-14

    申请号:US14338707

    申请日:2014-07-23

    CPC classification number: G06F17/30598 H04L41/064 H04L41/142 H04L43/04

    Abstract: A combined transaction execution monitoring, transaction classification and transaction execution performance anomaly detection system is disclosed. The system receives and analyzes transaction tracing data which may be provided by monitoring agents deployed to transaction executing entities like processes. In a first classification stage, parameters are extracted from received transaction tracing data, and the transaction tracing data is tagged with the extracted classification data. A subsequent measure extraction stage analyzes the classified transaction tracing data and creates corresponding measurements which are tagged with the transaction classifier. A following statistical analysis process maintains statistical data describing the long term statistical behavior of classified measures as a baseline, and also calculates corresponding statistical data describing the current statistical behavior of the classified measures. The statistical analysis process detects and notifies significant deviations between the statistical distribution of baseline and current measure data. A subsequent anomaly alerting and visualization stage processes those notifications.

    Method and system for tracing individual transactions over messaging systems without adding tracing information to messages
    2.
    发明授权
    Method and system for tracing individual transactions over messaging systems without adding tracing information to messages 有权
    通过消息传递系统跟踪单个事务而不向消息添加跟踪信息的方法和系统

    公开(公告)号:US09135138B2

    公开(公告)日:2015-09-15

    申请号:US14085882

    申请日:2013-11-21

    Abstract: A performance monitoring system is presented for monitoring and tracing individual transactions, where transaction processing includes sending and receiving messages using messaging systems that do not allow the augmentation of existing messages with monitoring system specific correlation information. Agents are deployed to sender and receiver applications that monitor and report transactions. Both sender and receiver applications are instrumented with sensors that detect and report sending or receiving of such immutable messages. Those sensors also extract correlation data from sent and received data allowing the identification of matching corresponding send/receive pairs. A mapping agent is used to retrieve mapping information from a messaging system which may alter the additional message identification data while messages travel through the system. This mapping information is additionally used for the correlation process.

    Abstract translation: 提出了一种性能监视系统,用于监视和跟踪单个事务,其中事务处理包括使用不允许使用监视系统特定的相关信息来扩充现有消息的消息系统来发送和接收消息。 代理被部署到监视和报告事务的发送者和接收者应用程序。 发送者和接收者应用程序都使用传感器来检测和报告发送或接收这种不可变消息。 这些传感器还从发送和接收数据中提取相关数据,允许识别匹配的相应发送/接收对。 映射代理用于从消息系统检索映射信息,消息传递系统可以在消息传播通过系统时改变附加消息标识数据。 该映射信息另外用于相关处理。

    Method and system for combining trace data describing multiple individual transaction executions with transaction processing infrastructure monitoring data
    3.
    发明授权
    Method and system for combining trace data describing multiple individual transaction executions with transaction processing infrastructure monitoring data 有权
    将描述多个单独事务执行的跟踪数据与事务处理基础架构监控数据组合的方法和系统

    公开(公告)号:US09451017B2

    公开(公告)日:2016-09-20

    申请号:US14338637

    申请日:2014-07-23

    Abstract: A transaction monitoring and tracing system which combines transactional performance monitoring aspects with infrastructure performance and utilization measures, like e.g. used memory or CPU load of transaction executing computing infrastructure. The system uses two types of agents deployed to the monitored system, a transaction and process agent, which is deployed to a process executing monitored transactions, and a host agent, which is deployed to a computer system executing processes monitored by a transaction and process agent. The transaction and process agent provides transaction tracing and process infrastructure measurements, the host agent provides host or operating system infrastructure measurements. All three types of measurements are tagged by the corresponding agent in a way that allows a later correlation of corresponding tracing and measurement data by an external monitoring node. Combining transactional and infrastructure monitoring allows fast detection of non-transactional root causes of monitored transaction performance degradations.

    Abstract translation: 交易监控和跟踪系统,将事务性能监控方面与基础设施绩效和利用措施相结合,如 处理执行计算基础设施的内存或CPU负载。 系统使用部署到被监视系统的两种类型的代理,被部署到执行被监视事务的进程的事务和进程代理,以及被部署到执行由事务和进程代理监视的进程的计算机系统的主机代理 。 事务和进程代理提供事务跟踪和进程基础结构测量,主机代理提供主机或操作系统基础架构测量。 所有三种类型的测量都被相应的代理标记,以允许外部监视节点随后对相应的跟踪和测量数据进行相关的方式。 结合事务和基础架构监控,可以快速检测监控事务性能下降的非事务根本原因。

    METHOD AND SYSTEM FOR REAL-TIME, FALSE POSITIVE RESISTANT, LOAD INDEPENDENT AND SELF-LEARNING ANOMALY DETECTION OF MEASURED TRANSACTION EXECUTION PARAMETERS LIKE RESPONSE TIMES
    4.
    发明申请
    METHOD AND SYSTEM FOR REAL-TIME, FALSE POSITIVE RESISTANT, LOAD INDEPENDENT AND SELF-LEARNING ANOMALY DETECTION OF MEASURED TRANSACTION EXECUTION PARAMETERS LIKE RESPONSE TIMES 有权
    方法和系统实时,假阳性,负荷独立和自学习异常检测测量交易执行参数类似的响应时间

    公开(公告)号:US20150032752A1

    公开(公告)日:2015-01-29

    申请号:US14338707

    申请日:2014-07-23

    CPC classification number: G06F17/30598 H04L41/064 H04L41/142 H04L43/04

    Abstract: A combined transaction execution monitoring, transaction classification and transaction execution performance anomaly detection system is disclosed. The system receives and analyzes transaction tracing data which may be provided by monitoring agents deployed to transaction executing entities like processes. In a first classification stage, parameters are extracted from received transaction tracing data, and the transaction tracing data is tagged with the extracted classification data. A subsequent measure extraction stage analyzes the classified transaction tracing data and creates corresponding measurements which are tagged with the transaction classifier. A following statistical analysis process maintains statistical data describing the long term statistical behavior of classified measures as a baseline, and also calculates corresponding statistical data describing the current statistical behavior of the classified measures. The statistical analysis process detects and notifies significant deviations between the statistical distribution of baseline and current measure data. A subsequent anomaly alerting and visualization stage processes those notifications.

    Abstract translation: 公开了组合事务执行监视,事务分类和事务执行性能异常检测系统。 系统接收和分析可由部署到事务执行实体(如进程)的监视代理提供的事务跟踪数据。 在第一分类阶段,从接收到的事务跟踪数据中提取参数,并且利用所提取的分类数据标记事务跟踪数据。 随后的测量提取阶段分析分类的事务跟踪数据,并创建用交易分类器标记的相应测量。 以下统计分析过程将统计数据描述为分类测量的长期统计行为为基准,并计算描述分类测量的当前统计行为的相应统计数据。 统计分析过程检测并通知基线统计分布与当前测量数据之间的显着偏差。 随后的异常报警和可视化阶段处理这些通知。

    METHOD AND SYSTEM FOR COMBINING TRACE DATA DESCRIBING MULTIPLE INDIVIDUAL TRANSACTION EXECUTIONS WITH TRANSACTION PROCESSING INFRASTRUCTURE MONITORING DATA
    5.
    发明申请
    METHOD AND SYSTEM FOR COMBINING TRACE DATA DESCRIBING MULTIPLE INDIVIDUAL TRANSACTION EXECUTIONS WITH TRANSACTION PROCESSING INFRASTRUCTURE MONITORING DATA 有权
    组合跟踪数据的方法和系统,用于描述具有交易处理基础设施监控数据的多个单独交易执行

    公开(公告)号:US20150032884A1

    公开(公告)日:2015-01-29

    申请号:US14338637

    申请日:2014-07-23

    Abstract: A transaction monitoring and tracing system which combines transactional performance monitoring aspects with infrastructure performance and utilization measures, like e.g. used memory or CPU load of transaction executing computing infrastructure. The system uses two types of agents deployed to the monitored system, a transaction and process agent, which is deployed to a process executing monitored transactions, and a host agent, which is deployed to a computer system executing processes monitored by a transaction and process agent. The transaction and process agent provides transaction tracing and process infrastructure measurements, the host agent provides host or operating system infrastructure measurements. All three types of measurements are tagged by the corresponding agent in a way that allows a later correlation of corresponding tracing and measurement data by an external monitoring node. Combining transactional and infrastructure monitoring allows fast detection of non-transactional root causes of monitored transaction performance degradations.

    Abstract translation: 交易监控和跟踪系统,将事务性能监控方面与基础设施绩效和利用措施相结合,如 处理执行计算基础设施的内存或CPU负载。 系统使用部署到被监视系统的两种类型的代理,被部署到执行被监视事务的进程的事务和进程代理,以及被部署到执行由事务和进程代理监视的进程的计算机系统的主机代理 。 事务和进程代理提供事务跟踪和进程基础结构测量,主机代理提供主机或操作系统基础架构测量。 所有三种类型的测量都被相应的代理标记,以允许外部监视节点随后对相应的跟踪和测量数据进行相关的方式。 结合事务和基础架构监控,可以快速检测监控事务性能下降的非事务根本原因。

    METHOD AND SYSTEM FOR TRACING INDIVIDUAL TRANSACTIONS OVER MESSAGING SYSTEMS WITHOUT ADDING TRACING INFORMATION TO MESSAGES
    6.
    发明申请
    METHOD AND SYSTEM FOR TRACING INDIVIDUAL TRANSACTIONS OVER MESSAGING SYSTEMS WITHOUT ADDING TRACING INFORMATION TO MESSAGES 有权
    跟踪消息传递信息的消息传递系统中的个人交易的方法和系统

    公开(公告)号:US20140149803A1

    公开(公告)日:2014-05-29

    申请号:US14085882

    申请日:2013-11-21

    Abstract: A performance monitoring system is presented for monitoring and tracing individual transactions, where transaction processing includes sending and receiving messages using messaging systems that do not allow the augmentation of existing messages with monitoring system specific correlation information. Agents are deployed to sender and receiver applications that monitor and report transactions. Both sender and receiver applications are instrumented with sensors that detect and report sending or receiving of such immutable messages. Those sensors also extract correlation data from sent and received data allowing the identification of matching corresponding send/receive pairs. A mapping agent is used to retrieve mapping information from a messaging system which may alter the additional message identification data while messages travel through the system. This mapping information is additionally used for the correlation process.

    Abstract translation: 提出了一种性能监视系统,用于监视和跟踪单个事务,其中事务处理包括使用不允许使用监视系统特定的相关信息来扩充现有消息的消息系统来发送和接收消息。 代理被部署到监视和报告事务的发送者和接收者应用程序。 发送者和接收者应用程序都使用传感器来检测和报告发送或接收这种不可变消息。 这些传感器还从发送和接收数据中提取相关数据,允许识别匹配的相应发送/接收对。 映射代理用于从消息系统检索映射信息,消息传递系统可以在消息传播通过系统时改变附加消息标识数据。 该映射信息另外用于相关处理。

Patent Agency Ranking