Abstract: Systems and methods for detecting injection exploits in a networked computing environment are disclosed. In one embodiment, a method for detection includes monitoring web applications that are executing and detecting when an execution function is received over a network and invoked, where an execution function is a function that accepts external free-form data values, detecting malicious code by generating a model of legitimate behavior subsequent to invocation of the execution function, comparing actual behavior to the model of legitimate behavior, and generating an alert when the actual behavior deviates from the model of legitimate behavior and validating whether the deviation of the actual behavior is due to one or more functions that accept external input.

Abstract: Systems and methods for detecting injection exploits in a networked computing environment are disclosed. In one embodiment, a method for detection includes monitoring web applications that are executing and detecting when an execution function is received over a network and invoked, where an execution function is a function that accepts external free-form data values, detecting malicious code by generating a model of legitimate behavior subsequent to invocation of the execution function, comparing actual behavior to the model of legitimate behavior, and generating an alert when the actual behavior deviates from the model of legitimate behavior and validating whether the deviation of the actual behavior is due to one or more functions that accept external input.

Abstract: To increase visibility into an application's performance, an application performance management system monitors transactions of an application at runtime to identify components or methods which significantly contribute to the execution of the transaction but are not instrumented. Since these methods are uninstrumented, the application performance management system has no visibility into and does not receive performance metrics for the methods. Identified components which contribute to the transaction are instrumented to decrease the visibility gap and provide additional performance information about the transaction of the application. During visibility gap detection, the agent analyzes runtimes of instrumented components to identify a component with a largest attributable runtime. The component is analyzed to identify uninstrumented, children components which it invokes.

Abstract: In various embodiments, a method of automatically identifying back-end components of a processing system may be performed. The method may include logging socket communications as a plurality of stack traces. The method may further include filtering the plurality of stack traces to identify a transaction from a particular thread, where the transaction includes a write stack trace and a read stack trace. The method may further include identifying, based on an examination of common stack elements between the write stack trace and the read stack trace, a candidate software component as a back-end component that is communicating with an external software component.

Abstract: A method includes performing, by a processor, receiving a user selection of a content item on a web page in a web browser executing on a device, determining a selection time associated with the user selection of the content item, identifying, based on the selection time, a page bucket for a web resource associated with the content item that was selected, associating the web resource with the page bucket that was identified, and communicating, to a network operator, performance information associated with the web page based on the page bucket.

Abstract: To allow trace generation regardless of the complexity of a distributed application, agents across a distributed application split transaction information into static data that identifies the subroutines of a software component and compact runtime data that is recorded for per transaction. A single instance of the static data is maintained for a software component while the compact runtime data is maintained for per transaction that invokes the software component. When a transaction satisfies a trace filter, the filter initiation component includes in a software component invocation for a subsequent transaction an identifier of the previous transaction that satisfied the trace filter. This transaction identifier propagates across the downstream components and causes the downstream components to generate and send trace segments constructed from the previously recorded runtime data for the identified previous transaction and the static subroutine identifying data for the respective component.

Abstract: In various embodiments, a method of automatically injecting an application script into application code may be performed. The method may include injecting an application script at an automatically identified first location within application code of a web page. The method may further include sending the application code including the application script to a web browser. The method may further include determining, based on whether metrics corresponding to the application script are received from the web browser, whether to automatically identify a second location within the application code at which to instead inject the application script.

Abstract: In various embodiments, a method of automatically identifying back-end components of a processing system may be performed. The method may include logging socket communications as a plurality of stack traces. The method may further include filtering the plurality of stack traces to identify a transaction from a particular thread, where the transaction includes a write stack trace and a read stack trace. The method may further include identifying, based on an examination of common stack elements between the write stack trace and the read stack trace, a candidate software component as a back-end component that is communicating with an external software component.

Abstract: In response to executing a first application component of a distributed application stack to process a first request to perform a first transaction received at a first device hosting the first application component and a second application component, operations are performed. The operations include determining a first context defining a first unique combination comprising a first value of an attribute of the first request and identification of a path of execution from a top of the distributed application stack to the first application component. The operations include assigning a first unique identifier to the first unique combination and monitoring a performance metric of the first application component to determine a first performance value of the first application component. The operations include adding the first performance value to a first accumulator value of a first accumulator that accumulates performance values for the first unique combination.

Abstract: Embodiments provide contextualization for collecting performance metrics of various application components based on values of attributes of an incoming request (a calling context). This contextualization is not limited to the highest level of the application stack. Rather, this contextualization based on attributes' values of an incoming request can be carried down through the application stack and to hardware performing operations for processes in the application stack. In other words, performance metrics can be separated based on the calling context at different levels of the application stack. Accordingly, the calling context includes a value of at least one attribute of the incoming request and a path from a top of the application stack to a location of the application component being executed.

Abstract: Methods for automatically identifying and instrumenting application classes and methods for a particular application are described. In some embodiments, application code (e.g., bytecode or source code) associated with the particular application may be parsed to identify classes and methods within the application code and to identify terminal components (e.g., methods or function calls) and non-terminal components (e.g., control flow statements). Once the terminal components and non-terminal components have been identified, a complexity model and a corresponding score for each of the classes and methods within the application code may be determined. The complexity model may be used to estimate the number of computations that may be required if a particular class or method is used by the particular application. Application classes and methods corresponding with a score that is greater than a threshold may be instrumented by inserting probes into the identified classes and methods.

Abstract: Methods for automatically identifying and instrumenting application classes and methods for a particular application are described. In some embodiments, application code (e.g., bytecode or source code) associated with the particular application may be parsed to identify classes and methods within the application code and to identify terminal components (e.g., methods or function calls) and non-terminal components (e.g., control flow statements). Once the terminal components and non-terminal components have been identified, a complexity model and a corresponding score for each of the classes and methods within the application code may be determined. The complexity model may be used to estimate the number of computations that may be required if a particular class or method is used by the particular application. Application classes and methods corresponding with a score that is greater than a threshold may be instrumented by inserting probes into the identified classes and methods.

Abstract: A benchmark response time is determined for a browser application request sent to a network server over a network. The response time is determined by performance monitoring code that is loaded into and monitors the browser application from the client. The performance monitoring code automatically sends a request to a network server; the request is not sent in response to user input. The network server receives the request, generates a response and provides the response to the browser application. The response includes a fixed amount of randomly generated data. The browser application receives and processes the response, but does not display the bytes or change the content displayed in the browser application as a result of the response. The browser application sends the times at which the browser application sends the request and the browser application completes processing the response data to the network server for further processing.

Abstract: A technique for monitoring software which efficiently communicates transaction trace data, including static and dynamic data, from an agent to a manager is disclosed. A tree data structure describes transactions as a sequence of transaction elements. Each branch may correspond to one type of transaction. The nodes along a branch may be associated with components of monitored software that are invoked to perform the transaction. A provisional branch may be constructed when an agent is unable to initially identify the transaction. Transaction data may be stored in association with the nodes in the provisional branch during the monitoring. After information needed to identify the transaction becomes available to the agent, the provisional branch is updated. The transaction data is reported in response to determining the branch in the tree data structure that matches the provisional branch.

Abstract: A technique for monitoring software which efficiently communicates transaction trace data, including static and dynamic data, from an agent to a manager is disclosed. A tree data structure describes transactions as a sequence of transaction elements. Each branch may correspond to one type of transaction. The nodes along a branch may be associated with components of monitored software that are invoked to perform the transaction. A provisional branch may be constructed when an agent is unable to initially identify the transaction. Transaction data may be stored in association with the nodes in the provisional branch during the monitoring. After information needed to identify the transaction becomes available to the agent, the provisional branch is updated. The transaction data is reported in response to determining the branch in the tree data structure that matches the provisional branch.

Abstract: Multiple transaction components that comprise a transaction are correlated using a GUID generated at a browser application. The transaction components may occur asynchronously or synchronously between a network browser and one or more applications. An identifier is generated for a set of network browser requests corresponding to a single user input or some other event and the identifier is included in each request. Server traffic and the servers processing the request are monitored and data which includes the identifier is generated. Data for the transaction with multiple transaction components is reported using the GUID associated with the transaction.

Abstract: Multiple transaction components that comprise a transaction are correlated using a GUID generated at a browser application. The transaction components may occur asynchronously or synchronously between a network browser and one or more applications. An identifier is generated for a set of network browser requests corresponding to a single user input or some other event and the identifier is included in each request. Server traffic and the servers processing the request are monitored and data which includes the identifier is generated. Data for the transaction with multiple transaction components is reported using the GUID associated with the transaction.

Abstract: Multiple transaction components that comprise a transaction are correlated using a GUID generated at a browser application. The transaction components may occur asynchronously or synchronously between a network browser and one or more applications. An identifier is generated for a set of network browser requests corresponding to a single user input or some other event and the identifier is included in each request. Server traffic and the servers processing the request are monitored and data which includes the identifier is generated. Data for the transaction with multiple transaction components is reported using the GUID associated with the transaction.

Abstract: Multiple transaction components that comprise a transaction are correlated using a GUID generated at a browser application. The transaction components may occur asynchronously or synchronously between a network browser and one or more applications. An identifier is generated for a set of network browser requests corresponding to a single user input or some other event and the identifier is included in each request. Server traffic and the servers processing the request are monitored and data which includes the identifier is generated. Data for the transaction with multiple transaction components is reported using the GUID associated with the transaction.

Abstract: A benchmark response time is determined for a browser application request sent to a network server over a network. The response time is determined by performance monitoring code that is loaded into and monitors the browser application from the client. The performance monitoring code automatically sends a request to a network server; the request is not sent in response to user input. The network server receives the request, generates a response and provides the response to the browser application. The response includes a fixed amount of randomly generated data. The browser application receives and processes the response, but does not display the bytes or change the content displayed in the browser application as a result of the response. The browser application sends the times at which the browser application sends the request and the browser application completes processing the response data to the network server for further processing.