Abstract: A technology is disclosed for maximizing the creation of transaction trace data by multiple, different monitoring data sources like agents having individual volume constraints for created trace data. Trace context data identifying individual transactions and containing shared randomness data is propagated between agents and used in created trance data to maintain transaction identity in trace data fragments and for consistent sampling decisions. Sampling decisions for individual trace data fragments are based on the shared randomness data and on an agent-autonomously defined sampling probability. Values of randomness data and sampling probability are restricted to a limited number, like the values of a geometric series with a common ratio of ½. Shared randomness data and sampling probability are included in created trace data.

Abstract: Systems and methods for monitoring database queries in a distributed computing environment are provided. An agent instrumented in an application executing a computer transaction receives a database statement and modifies it by adding metadata. The agent sends the modified database statement to a database system and sends monitoring data, including the metadata, to a remotely located monitor server. In response to execution of the database statement, the database system generates diagnostic data. The monitor server retrieves the diagnostic data from the database system and correlates the retrieved diagnostic data with the monitoring data using the metadata. This allows for automated, end-to-end performance correlation extending from the application layer down to the database layer without interfering with database statement behavior.

Abstract: A technology is disclosed for fast and straightforward development of complex, multi-layered analysis processes for semi-structured application monitoring data. The analysis process is divided into sub-tasks, like moving to/identifying portions of monitoring data that needs to be analyzed and performing statistical analyses on identified monitoring data portions. Generic, configurable analysis components performing those sub-tasks are provided. Those analysis components include interfaces to access monitoring data, to communicate analysis results with other analysis components, and to provide visualization data for the results of performed analyses. An analysis process definition language is used to compose networks of interacting analysis nodes, which in cooperation implement arbitrarily complex analysis tasks. An interactive analysis design environment combines means to configure and interconnect those analysis components with their capability.

Abstract: A system and method for the structured automation of the delivery and operation of software functionality is proposed. A declarative notation approach is used to describe automation sequences independently from concrete automation tools and services that may be used to execute the automation sequences. An automation service abstraction layer is introduced that hides concrete automation service characteristics from the declarative automation definition layer. The service abstraction layer enables a transparent change or update of concrete automation service without affecting automation sequences that use the corresponding service abstractions. For operation automation, the automation execution may be combined with causation-capable monitoring systems that both identifies critical changes of operating conditions for which automated remediation is indicated and corresponding root cause changes for those critical changes.

Abstract: A technology is disclosed for maximizing the creation of transaction trace data by multiple, different monitoring data sources like agents having individual volume constraints for created trace data. Trace context data identifying individual transactions and containing shared randomness data is propagated between agents and used in created trance data to maintain transaction identity in trace data fragments and for consistent sampling decisions. Sampling decisions for individual trace data fragments are based on the shared randomness data and on an agent-autonomously defined sampling probability. Values of randomness data and sampling probability are restricted to a limited number, like the values of a geometric series with a common ratio of 1/2. Shared randomness data and sampling probability are included in created trace data.

Abstract: A technology is disclosed for the browser side capturing of user interaction session data and replay of the session data for a high-fidelity reconstruction of the experience the user perceived. In addition to capturing central structuring and markup documents and browser side updates thereof, additional resource documents that are loaded and used by the browser to render the central documents are captured and added to the session recording data. Identification information is created for resource documents, based on the content of those documents, which allows the capturing system to distinguish different versions of those content documents that share the same name but have different content. The captured session data contains data to identify the correct versions of resource documents during replay. Various measures to reduce the amount of transferred resource content data are applied, that consider already captured resource document versions or the usage frequency of a monitored application.

Abstract: A computer-implemented method is presented for identifying vulnerable software from a computer system. The method includes: identifying name of a given software component in a vulnerability database by analyzing text of an entry in the vulnerability database using a large language model, where entries in the vulnerability database have known vulnerabilities; identifying a patch for the given software component in a source code repository by analyzing text of the entry in the vulnerability database using the large language model; identifying the patch for the given software component in the source code repository by analyzing text in the source code repository using the large language model; and reporting the given software component as being vulnerable in response to identifying the patch for the given software component in the source code repository.

Abstract: Technologies are disclosed herein that are directed to the improvement of vulnerability assessment process by avoiding false positive vulnerabilities caused by vendor specific backports of vulnerability fixes that are not considered by conventional vulnerability assessment systems. To secure their software products, vendors identify components that are affected by vulnerabilities used by their products and apply vulnerability fixes introduced by later component versions to those component versions used in their products. This created “gaps” in vulnerable component version ranges provided by public vulnerability intelligence data streams. Vulnerability assessment processes that solely rely on public vulnerability intelligence data incorrectly report vulnerabilities for component versions containing such backported vulnerability fixes.

Abstract: The disclosure relates to a computer-implemented method for extracting data from textual records. The technical problems solved by the disclosure are i) to generate an extraction pattern for extracting a selected data field from a reference record, ii) to improve the robustness of the extraction pattern by reducing its length, and iii) to extract the selected field from a set of records. The solution comprises determining whether the extraction pattern is disjoint to any segment of the preceding pattern; forming a new extraction pattern by inserting the data type for last data field in the preceding pattern at the beginning of the extraction pattern; and repeating the previous steps with the new extraction pattern until the new extraction pattern is disjoint to all segment comprising the preceding pattern.

Abstract: Technologies are disclosed for the automated, rule-based generation of models from arbitrary, semi-structured observation data. Context data of received observation data, like data describing the location of on which a phenomenon was observed, is used to identify related observations, to generate entities in a model describing the observed data and to assign observations to model data. Mapping rules may be used for the on-demand generation of models, and different sets of mapping rules may be used to generate different models out of the same observation data for different purposes. Further, observation time data may be used to observer the temporal evolution of the generated model. Possible use cases of the so generated models include the interpretation of observation data that describes unexpected operation conditions in view of the generated model, or to determine how a monitored system reacts on changing conditions, like increased load.

Abstract: A computer-implemented method is presented for storing log data generated in a distributed computing environment.

Abstract: A computer-implemented method for storing and querying application performance monitoring (APM) data in a database, includes receiving data records of APM data, each data record associated to a key; storing the data records in storage containers in the database, each record stored in one storage container and each storage container identified by a unique storage identifier; assigning a unique index value to each unique key; defining a distribution function mapping the keys to the index values; generating a secondary function to approximate the distribution function; defining a mapping function to map the index values to lists of storage identifiers; and in response to a request to retrieve data records for a specified key or keys, querying the database to identify a list of storage identifiers based on the secondary function and the mapping function and retrieving the data records for the specified key or keys.

Abstract: A computer-implemented method is presented for extracting data from textual records. The objective of the disclosure is to identify the most appropriate pattern in a set of patterns for extracting data from data records and by applying the most appropriate pattern to a plurality of data records, to robustly extract data from textual records.

Abstract: A unified storage format is presented for received observation data records of various formats, including individual observations or histograms and pre-sampled records describing multiple observations. The proposed storage format also supports various data reduction technologies, including coarsening of time and observation value resolutions, where the proposed data reduction technologies retain data describing the quantity of observations. In addition, sampling-based data reduction approaches are described, which at least retain the statistical expectancy value for the number of observations. Further, a definition and storage format for histogram buckets is provided with guaranteed relative error behavior over the whole value range of observation data, that only requires the definition of a number of significant bits for the recording and interpretation of histogram data. The proposed histogram storage scheme is applicable to integer and floating-point observation data.

Abstract: A computer-implemented method is presented for storing log data generated in a distributed computing environment.

Abstract: A computer-implemented method is presented for visualizing log data captured in a computer system. The method includes: receiving a plurality of log records, where each log record includes a severity indicator; grouping log records in the plurality of log records into groups of log records, such that log records in a given group of records are chronological; for each group of log records, extracting one or more templates from a given group of log records, where each template is comprised of a text string representing log records in the given group of log records; for each group of log records, computing a similarity measure between a given group of log records and the remaining groups of log records; and visualizing the groups of log records by projecting each group of log records onto a multi-dimensional plane based on the similarity measures for the groups of log records and connecting projections for the groups of log records in chronological order using a line.

Abstract: The present disclosure relates to the detection of cross-site scripting vulnerabilities in a web application. The objective of the disclosure is to find a computer-implemented method for detecting cross-site scripting vulnerabilities in a web application. The detection of XSS vulnerabilities shall be performed automatically and the number of false positives shall be reduced compared to the prior art.

Abstract: A computer-implemented method is presented for determining primary keys in a table of a database system. The method includes: determining a number of rows in the table; for a given column of the table, generating a probabilistic data structure for the given column, where the probabilistic data structure is partitioned into a plurality of registers and configuration parameters for the probabilistic data structure includes a first recording parameter, base, that controls recording of data into the probabilistic data structure; computing a cardinality estimate for the given column using the probabilistic data structure; computing a ratio between the cardinality estimate for the given column and the number of rows in the table; comparing the ratio to a threshold; and designating the given column as a primary key for the table in response to the ratio being greater than the threshold.

Abstract: A system and method for real-time discovery and monitoring of multidimensional topology models describing structural aspects of applications and of computing infrastructure used to execute those applications is disclosed. Different types of agents are deployed to the monitored application execution infrastructure dedicated to capture specific topological aspects of the monitored system. Virtualization agents detect and monitor the virtualization structure of virtualized hardware used in the execution infrastructure, operating system agents deployed to individual operating systems monitor resource utilization, performance and communication of processes executed by the operating system and transaction agents deployed to processes participating in the execution of transactions, providing end-to-end transaction trace and monitoring data describing individual transaction executions.

Abstract: A prioritized method is presented for updating software in a distributed computing environment. The objective of the disclosure is to find a computer-implemented method for updating software on pods in the distributed computing environment. This is solved by calculating a risk rating for each pod in the manifest, taking into account a vulnerability score of the pod, the minimum number of inbound hops for reaching the pod, and the communication relationship between the given pod and other pods. Pods in the manifest are updated in accordance with the calculated risk ratings.