Abstract: A system and method is proposed for estimating the contribution of components of a distributed computing environment to the generation of economically relevant values, like e.g., revenue numbers. Agents are deployed to the computing environment that trace executed transactions and that monitor components used to execute those transactions. The transaction trace data also contains data about the origin/user of transactions, which may be used to group transactions corresponding to particular interactions of individual users with the monitored application into visit data. Data describing economically relevant activities of transactions, like the purchase of goods, are also observed by agents and reported in trace data. Functional dependencies described in transaction trace data and resource related dependencies derived from component monitoring data are used to identify functionality and components that contributed to the generation of business value.

Abstract: A technology to identify processing paths of untrusted input data received by applications that are vulnerable to attacks and to further detect and prevent actual attacks that try to exploit those vulnerabilities is disclosed. Application code is augmented at run-time with sensor code which detects the entry of input-data into the application and further traces the propagation, manipulation and, sanitization of this input-data until its usage in a data sink. The so generated data-flow traces reveal data-flow paths that lack required sanitization measures to neutralize potentially harmful input-data. Such data-flow paths are reported as vulnerabilities. Further, input-data that reaches data-sink interfaces is scanned by data-sink sensors to identify harmful input data. On identification of harmful input data, an attack is reported, and countermeasures are applied to prevent the identified attack.

Abstract: A technology for the optimized capturing of resource file content for resources referred in recorded user interaction sequences is disclosed. Individual resource files are typically referred in multiple recorded resources, therefore it is desired to capture those resources only once and reuse them for all recorded session capturing them. As user interaction sequences are executed and captured in independently operating web-browsers, a direct coordination between recording web-browsers to avoid multiple captures of the same resource is not possible. Data about the global resource capturing and demand situation is generated on a monitoring server that receives all session recording data and transferred to session recording browsers in form of lists identifying resources that are referred in sessions but are still unresolved and should therefore be captured, and for resources that should not captured, because they are already available and capturing them again should be avoided.

Abstract: A system and method is disclosed for injecting in-process agents into processes executing self-contained, statically linked binaries that do not interact with a dynamic loader mechanism that identifies and resolves required libraries at run time. System calls directed to the execution of binaries in processes are intercepted and the targeted binary is analyzed to determine whether it is statically linked. In case a statically linked binary is identified, a proxy launcher process is started instead of the binary which starts the original binary as traceable child process. After the child process has loaded the original binary into its process memory, the memory image of the child process is copied to the launcher process and the child process is terminated. An agent is loaded into the launcher process to instruments the copied memory image.

Abstract: A technology is disclosed for the browser side capturing of user interaction session data and replay of the session data for a high-fidelity reconstruction of the experience the user perceived. In addition to capturing central structuring and markup documents and browser side updates thereof, additional resource documents that are loaded and used by the browser to render the central documents are captured and added to the session recording data. Identification information is created for resource documents, based on the content of those documents, which allows the capturing system to distinguish different versions of those content documents that share the same name but have different content. The captured session data contains data to identify the correct versions of resource documents during replay. Various measures to reduce the amount of transferred resource content data are applied, that consider already captured resource document versions or the usage frequency of a monitored application.

Abstract: A system and method for the structured automation of the delivery and operation of software functionality is proposed. A declarative notation approach is used to describe automation sequences independently from concrete automation tools and services that may be used to execute the automation sequences. An automation service abstraction layer is introduced that hides concrete automation service characteristics from the declarative automation definition layer. The service abstraction layer enables a transparent change or update of concrete automation service without affecting automation sequences that use the corresponding service abstractions. For operation automation, the automation execution may be combined with causation-capable monitoring systems that both identifies critical changes of operating conditions for which automated remediation is indicated and corresponding root cause changes for those critical changes.

Abstract: A system and method is disclosed for injecting in-process agents into processes executing self-contained, statically linked binaries that do not interact with a dynamic loader mechanism that identifies and resolves required libraries at run time. System calls directed to the execution of binaries in processes are intercepted and the targeted binary is analyzed to determine whether it is statically linked. In case a statically linked binary is identified, a proxy launcher process is started instead of the binary which starts the original binary as traceable child process. After the child process has loaded the original binary into its process memory, the memory image of the child process is copied to the launcher process and the child process is terminated. An agent is loaded into the launcher process to instruments the copied memory image.

Abstract: A system and method for the analysis of log data is presented. The system uses SuperMinHash based locality sensitive hash signatures to describe the similarity between log lines. Signatures are created for incoming log lines and stored in signature indexes. Later similarity queries use those indexes to improve the query performance. The SuperMinHash algorithm uses a two staged approach to determine signature values, one stage uses a first random number to calculate the index of the signature value that is to update. The two staged approach improves the accuracy of the produced similarity estimation data for small sized signatures. The two staged approach may further be used to produce random numbers that are related, e.g. each created random number may be larger than its predecessors. This relation is used to optimize the algorithm by determining and terminating when further created random numbers have no influence on the created signature.

Abstract: A technology to identify processing paths of untrusted input data received by applications that are vulnerable to attacks and to further detect and prevent actual attacks that try to exploit those vulnerabilities is disclosed. Application code is augmented at run-time with sensor code which detects the entry of input-data into the application and further traces the propagation, manipulation and, sanitization of this input-data until its usage in a data sink. The so generated data-flow traces reveal data-flow paths that lack required sanitization measures to neutralize potentially harmful input-data. Such data-flow paths are reported as vulnerabilities. Further, input-data that reaches data-sink interfaces is scanned by data-sink sensors to identify harmful input data. On identification of harmful input data, an attack is reported, and countermeasures are applied to prevent the identified attack.

Abstract: A technology is disclosed for maximizing the creation of transaction trace data by multiple, different monitoring data sources like agents having individual volume constraints for created trace data. Trace context data identifying individual transactions and containing shared randomness data is propagated between agents and used in created trance data to maintain transaction identity in trace data fragments and for consistent sampling decisions. Sampling decisions for individual trace data fragments are based on the shared randomness data and on an agent-autonomously defined sampling probability. Values of randomness data and sampling probability are restricted to a limited number, like the values of a geometric series with a common ratio of ½. Shared randomness data and sampling probability are included in created trace data.

Abstract: A technology for the optimized capturing of resource file content for resources referred in recorded user interaction sequences is disclosed. Individual resource files are typically referred in multiple recorded resources, therefore it is desired to capture those resources only once and reuse them for all recorded session capturing them. As user interaction sequences are executed and captured in independently operating web-browsers, a direct coordination between recording web-browsers to avoid multiple captures of the same resource is not possible. Data about the global resource capturing and demand situation is generated on a monitoring server that receives all session recording data and transferred to session recording browsers in form of lists identifying resources that are referred in sessions but are still unresolved and should therefore be captured, and for resources that should not captured, because they are already available and capturing them again should be avoided.

Abstract: A technology is disclosed for the browser side capturing of user interaction session data and replay of the session data for a high-fidelity reconstruction of the experience the user perceived. In addition to capturing central structuring and markup documents and browser side updates thereof, additional resource documents that are loaded and used by the browser to render the central documents are captured and added to the session recording data. Identification information is created for resource documents, based on the content of those documents, which allows the capturing system to distinguish different versions of those content documents that share the same name but have different content. The captured session data contains data to identify the correct versions of resource documents during replay. Various measures to reduce the amount of transferred resource content data are applied, that consider already captured resource document versions or the usage frequency of a monitored application.

Abstract: A system and method for the structured automation of the delivery and operation of software functionality is proposed. A declarative notation approach is used to describe automation sequences independently from concrete automation tools and services that may be used to execute the automation sequences. An automation service abstraction layer is introduced that hides concrete automation service characteristics from the declarative automation definition layer. The service abstraction layer enables a transparent change or update of concrete automation service without affecting automation sequences that use the corresponding service abstractions. For operation automation, the automation execution may be combined with causation-capable monitoring systems that both identifies critical changes of operating conditions for which automated remediation is indicated and corresponding root cause changes for those critical changes.

Abstract: A system and a method for grouping log lines in application log file is presented. The system uses logging framework code instrumentation in order to obtain a relation between the actual log line and the place in source code from which a method responsible for writing the line has been called. As the all information on the relation is stored in external metadata files, the structure of the log files remains unchanged. Using the above mentioned metadata and a raw log file, each log line in the file can be assigned to a group related to the place in source code from which the line has been logged, by the system. Next such a grouped log file can be displayed to the user in order to simplify the analysis of the application behavior.

Abstract: A technology is disclosed for automated risk analysis for the deployment of software component updates in complex microservice architectures. Dependencies and versions of deployment situations in test setup environments and in a target environment are analyzed and compared to identify a version delta between tested and production deployments. Further, test results for test deployments are used to identify and remove unsuccessful test setups. Successful test setups are ranked according to extend of their version delta against the target environment and one of the successful test setups is selected according to a deployment strategy. After a test setup is selected, a deployment plan considering service versions and dependencies is generated that guarantees a tested and functional state of the target environment after each deployment step.

Abstract: A system and method for the analysis of log data is presented. The system uses SuperMinHash based locality sensitive hash signatures to describe the similarity between log lines. Signatures are created for incoming log lines and stored in signature indexes. Later similarity queries use those indexes to improve the query performance. The SuperMinHash algorithm uses a two staged approach to determine signature values, one stage uses a first random number to calculate the index of the signature value that is to update. The two staged approach improves the accuracy of the produced similarity estimation data for small sized signatures. The two staged approach may further be used to produce random numbers that are related, e.g. each created random number may be larger than its predecessors. This relation is used to optimize the algorithm by determining and terminating when further created random numbers have no influence on the created signature.

Abstract: A system and method for the creation of locality sensitive hash signatures using weighted feature sets is disclosed. The disclosed methodology takes advantage of discretization mechanisms commonly used in computer systems to model the influence of the feature weights on the calculated hash signature. Pseudo random numbers required for the signature calculation are created in ascending order, which enables the signature generation mechanism to identify and avoid the unnecessary creation of pseudo random numbers to improve the performance of the signature calculation process. Further, hierarchic, tree-search like algorithms are used during the processing of signature weights to further decrease the number of required random numbers. The features of the Poisson Process model, like its ability to provide random numbers in ascending order and the split-and mergeability of Poisson Processes are used to further improve the performance of the signature calculation process.

Abstract: A technology is disclosed for the efficient capturing of monitoring data capable to reconstruct the experience of a user during the interaction with an application on a mobile device. The proposed approach uses instrumentation to detect the occurrence of events that change the user interface of the monitored application and that, in response to such an event, identifies the fraction of the user interface that was altered by the event and then captures only the changed portion of the user interface display. Additionally, privacy configuration data is evaluated during the capturing process to identify portions of the user interface that contain data that is protected due to privacy policy settings. In case an event changes such a privacy protected user interface portion, only the occurrence of the event and the affected screen area are captured, but no actual display data.

Abstract: A probabilistic set sketching data structure for the estimation of properties of individual sets, like cardinality, as well as joint parameters describing relations between different sets, like similarity scores or intersection cardinalities. The memory size of the proposed sketch is widely independent of the size of the observed sets and may be chosen primarily based on the desired estimation error. A tuning parameter controls the amount of information stored in the sketch regarding the content of the monitored set and may be used to trade joint parameter estimation accuracy for sketch size. Improved estimation algorithms are proposed for both cardinality and joint quantities. Especially the proposed joint quantity estimation has considerable advantages, as it reduces the problem of estimating three dependent parameters, like the cardinalities of intersections and the two complements to the estimation of only one parameter, like the Jaccard coefficient.

Abstract: A system and method for the distributed analysis of high frequency transaction trace data to constantly categorize incoming transaction data, identify relevant transaction categories, create per-category statistical reference and current data and perform statistical tests to identify transaction categories showing overall statistically relevant performance anomalies. The relevant transaction category detection considers both the relative transaction frequency of categories compared to the overall transaction frequency and the temporal stability of a transaction category over an observation duration. The statistical data generated for the anomaly tests contains next to data describing the overall performance of transactions of a category also data describing the transaction execution context, like the number of concurrently executed transactions or transaction load during an observation period.