Abstract: The disclosure concerns a computer-implemented method for semantically analyzing session data, a computer-implemented method for identifying fraudulent session data captured in a distributed computing system, and a computer-implemented method for synthetically testing a website. The objective of the disclosure is to propose a similarity measure for session data in order to compare different sessions, such as user sessions or business process journeys, to each other. Another objective of the disclosure is to semantically analyze session data by similarity and to store the analysis result in a database. The objective is solved by receiving session data from a session occurring in the distributed computing system; generating a textual description for the session data; generating a vector embedding from the textual description, where the vector embedding represents the session data; and storing the vector embedding, along with a reference to the session data, in a database.

Abstract: A technology is presented for the efficient matching of received data elements with medium to large sets of fluctuating matching rules. To cope with high volumes of data elements, a distributed architecture is used, which leverages optimized multi-rule evaluation approaches, like Intel's Hyperscan, to achieve sublinear computational complexity for the rule matching process. Processing of rule updates, and generation of corresponding optimized evaluation instructions is performed on a central management node, which distributes generated optimized matching code to multiple worker nodes for the actual matching process. Further, optimized multi-rule evaluation is combined with application of individual match rules, to support the fast application of matching rule changes if required. Compilation strategies are applied to eventually transform individually applied rules into a corresponding optimized multi-rule evaluation form.

Abstract: A technology for the optimized capturing of resource file content for resources referred in recorded user interaction sequences is disclosed. Individual resource files are typically referred in multiple recorded resources, therefore it is desired to capture those resources only once and reuse them for all recorded session capturing them. As user interaction sequences are executed and captured in independently operating web-browsers, a direct coordination between recording web-browsers to avoid multiple captures of the same resource is not possible. Data about the global resource capturing and demand situation is generated on a monitoring server that receives all session recording data and transferred to session recording browsers in form of lists identifying resources that are referred in sessions but are still unresolved and should therefore be captured, and for resources that should not captured, because they are already available and capturing them again should be avoided.

Abstract: Technologies are disclosed for the automated, rule-based generation of models from arbitrary, semi-structured observation data. Context data of received observation data, like data describing the location of on which a phenomenon was observed, is used to identify related observations, to generate entities in a model describing the observed data and to assign observations to model data. Mapping rules may be used for the on-demand generation of models, and different sets of mapping rules may be used to generate different models out of the same observation data for different purposes. Further, observation time data may be used to observer the temporal evolution of the generated model. Possible use cases of the so generated models include the interpretation of observation data that describes unexpected operation conditions in view of the generated model, or to determine how a monitored system reacts on changing conditions, like increased load.

Abstract: A technology is disclosed for the browser side capturing of user interaction session data and replay of the session data for a high-fidelity reconstruction of the experience the user perceived. In addition to capturing central structuring and markup documents and browser side updates thereof, additional resource documents that are loaded and used by the browser to render the central documents are captured and added to the session recording data. Identification information is created for resource documents, based on the content of those documents, which allows the capturing system to distinguish different versions of those content documents that share the same name but have different content. The captured session data contains data to identify the correct versions of resource documents during replay. Various measures to reduce the amount of transferred resource content data are applied, that consider already captured resource document versions or the usage frequency of a monitored application.

Abstract: Methods and technologies are disclosed for the sketch efficient estimation of large-scale multi-sets in distributed, stream-oriented environments. Sketch updates are idempotent and commutative, to support duplicate set elements and varying element sequences. They are also mergeable to support distributed sketch recording. The recording process uses stepwise approximated geometric distributions, efficiently generated from NLZ values of received sketch updates, by using only multiplications with powers of two and integer additions. Sketch registers are subdivided into a portion storing an observed max update value for the register, and a portion storing set of flag bits indicating observed next smaller update values for the register. A Max Likelihood base sketch data evaluation, based on the assumption of statistically independent sketch registers is proposed.

Abstract: A technology for the optimized capturing of resource file content for resources referred in recorded user interaction sequences is disclosed. Individual resource files are typically referred in multiple recorded resources, therefore it is desired to capture those resources only once and reuse them for all recorded session capturing them. As user interaction sequences are executed and captured in independently operating web-browsers, a direct coordination between recording web-browsers to avoid multiple captures of the same resource is not possible. Data about the global resource capturing and demand situation is generated on a monitoring server that receives all session recording data and transferred to session recording browsers in form of lists identifying resources that are referred in sessions but are still unresolved and should therefore be captured, and for resources that should not captured, because they are already available and capturing them again should be avoided.

Abstract: Technologies are disclosed for the automated, rule-based generation of models from arbitrary, semi-structured observation data. Context data of received observation data, like data describing the location of on which a phenomenon was observed, is used to identify related observations, to generate entities in a model describing the observed data and to assign observations to model data. Mapping rules may be used for the on-demand generation of models, and different sets of mapping rules may be used to generate different models out of the same observation data for different purposes. Further, observation time data may be used to observer the temporal evolution of the generated model. Possible use cases of the so generated models include the interpretation of observation data that describes unexpected operation conditions in view of the generated model, or to determine how a monitored system reacts on changing conditions, like increased load.

Abstract: A technology is disclosed for the browser side capturing of user interaction session data and replay of the session data for a high-fidelity reconstruction of the experience the user perceived. In addition to capturing central structuring and markup documents and browser side updates thereof, additional resource documents that are loaded and used by the browser to render the central documents are captured and added to the session recording data. Identification information is created for resource documents, based on the content of those documents, which allows the capturing system to distinguish different versions of those content documents that share the same name but have different content. The captured session data contains data to identify the correct versions of resource documents during replay. Various measures to reduce the amount of transferred resource content data are applied, that consider already captured resource document versions or the usage frequency of a monitored application.

Abstract: A system and method for the analysis of log data is presented. The system uses SuperMinHash based locality sensitive hash signatures to describe the similarity between log lines. Signatures are created for incoming log lines and stored in signature indexes. Later similarity queries use those indexes to improve the query performance. The SuperMinHash algorithm uses a two staged approach to determine signature values, one stage uses a first random number to calculate the index of the signature value that is to update. The two staged approach improves the accuracy of the produced similarity estimation data for small sized signatures. The two staged approach may further be used to produce random numbers that are related, e.g. each created random number may be larger than its predecessors. This relation is used to optimize the algorithm by determining and terminating when further created random numbers have no influence on the created signature.

Abstract: A system and method is proposed for estimating the contribution of components of a distributed computing environment to the generation of economically relevant values, like e.g., revenue numbers. Agents are deployed to the computing environment that trace executed transactions and that monitor components used to execute those transactions. The transaction trace data also contains data about the origin/user of transactions, which may be used to group transactions corresponding to particular interactions of individual users with the monitored application into visit data. Data describing economically relevant activities of transactions, like the purchase of goods, are also observed by agents and reported in trace data. Functional dependencies described in transaction trace data and resource related dependencies derived from component monitoring data are used to identify functionality and components that contributed to the generation of business value.

Abstract: A system and method for the creation of locality sensitive hash signatures using weighted feature sets is disclosed. The disclosed methodology takes advantage of discretization mechanisms commonly used in computer systems to model the influence of the feature weights on the calculated hash signature. Pseudo random numbers required for the signature calculation are created in ascending order, which enables the signature generation mechanism to identify and avoid the unnecessary creation of pseudo random numbers to improve the performance of the signature calculation process. Further, hierarchic, tree-search like algorithms are used during the processing of signature weights to further decrease the number of required random numbers. The features of the Poisson Process model, like its ability to provide random numbers in ascending order and the split—and mergeability of Poisson Processes are used to further improve the performance of the signature calculation process.

Abstract: A system and method is proposed for estimating the contribution of components of a distributed computing environment to the generation of economically relevant values, like e.g., revenue numbers. Agents are deployed to the computing environment that trace executed transactions and that monitor components used to execute those transactions. The transaction trace data also contains data about the origin/user of transactions, which may be used to group transactions corresponding to particular interactions of individual users with the monitored application into visit data. Data describing economically relevant activities of transactions, like the purchase of goods, are also observed by agents and reported in trace data. Functional dependencies described in transaction trace data and resource related dependencies derived from component monitoring data are used to identify functionality and components that contributed to the generation of business value.

Abstract: A technology for the optimized capturing of resource file content for resources referred in recorded user interaction sequences is disclosed. Individual resource files are typically referred in multiple recorded resources, therefore it is desired to capture those resources only once and reuse them for all recorded session capturing them. As user interaction sequences are executed and captured in independently operating web-browsers, a direct coordination between recording web-browsers to avoid multiple captures of the same resource is not possible. Data about the global resource capturing and demand situation is generated on a monitoring server that receives all session recording data and transferred to session recording browsers in form of lists identifying resources that are referred in sessions but are still unresolved and should therefore be captured, and for resources that should not captured, because they are already available and capturing them again should be avoided.

Abstract: A technology is disclosed for the browser side capturing of user interaction session data and replay of the session data for a high-fidelity reconstruction of the experience the user perceived. In addition to capturing central structuring and markup documents and browser side updates thereof, additional resource documents that are loaded and used by the browser to render the central documents are captured and added to the session recording data. Identification information is created for resource documents, based on the content of those documents, which allows the capturing system to distinguish different versions of those content documents that share the same name but have different content. The captured session data contains data to identify the correct versions of resource documents during replay. Various measures to reduce the amount of transferred resource content data are applied, that consider already captured resource document versions or the usage frequency of a monitored application.

Abstract: A system and method for the analysis of log data is presented. The system uses SuperMinHash based locality sensitive hash signatures to describe the similarity between log lines. Signatures are created for incoming log lines and stored in signature indexes. Later similarity queries use those indexes to improve the query performance. The SuperMinHash algorithm uses a two staged approach to determine signature values, one stage uses a first random number to calculate the index of the signature value that is to update. The two staged approach improves the accuracy of the produced similarity estimation data for small sized signatures. The two staged approach may further be used to produce random numbers that are related, e.g. each created random number may be larger than its predecessors. This relation is used to optimize the algorithm by determining and terminating when further created random numbers have no influence on the created signature.

Abstract: A technology is disclosed for maximizing the creation of transaction trace data by multiple, different monitoring data sources like agents having individual volume constraints for created trace data. Trace context data identifying individual transactions and containing shared randomness data is propagated between agents and used in created trance data to maintain transaction identity in trace data fragments and for consistent sampling decisions. Sampling decisions for individual trace data fragments are based on the shared randomness data and on an agent-autonomously defined sampling probability. Values of randomness data and sampling probability are restricted to a limited number, like the values of a geometric series with a common ratio of ½. Shared randomness data and sampling probability are included in created trace data.

Abstract: A technology for the optimized capturing of resource file content for resources referred in recorded user interaction sequences is disclosed. Individual resource files are typically referred in multiple recorded resources, therefore it is desired to capture those resources only once and reuse them for all recorded session capturing them. As user interaction sequences are executed and captured in independently operating web-browsers, a direct coordination between recording web-browsers to avoid multiple captures of the same resource is not possible. Data about the global resource capturing and demand situation is generated on a monitoring server that receives all session recording data and transferred to session recording browsers in form of lists identifying resources that are referred in sessions but are still unresolved and should therefore be captured, and for resources that should not captured, because they are already available and capturing them again should be avoided.

Abstract: A technology is disclosed for the browser side capturing of user interaction session data and replay of the session data for a high-fidelity reconstruction of the experience the user perceived. In addition to capturing central structuring and markup documents and browser side updates thereof, additional resource documents that are loaded and used by the browser to render the central documents are captured and added to the session recording data. Identification information is created for resource documents, based on the content of those documents, which allows the capturing system to distinguish different versions of those content documents that share the same name but have different content. The captured session data contains data to identify the correct versions of resource documents during replay. Various measures to reduce the amount of transferred resource content data are applied, that consider already captured resource document versions or the usage frequency of a monitored application.

Abstract: A system and method for the analysis of log data is presented. The system uses SuperMinHash based locality sensitive hash signatures to describe the similarity between log lines. Signatures are created for incoming log lines and stored in signature indexes. Later similarity queries use those indexes to improve the query performance. The SuperMinHash algorithm uses a two staged approach to determine signature values, one stage uses a first random number to calculate the index of the signature value that is to update. The two staged approach improves the accuracy of the produced similarity estimation data for small sized signatures. The two staged approach may further be used to produce random numbers that are related, e.g. each created random number may be larger than its predecessors. This relation is used to optimize the algorithm by determining and terminating when further created random numbers have no influence on the created signature.