Patent Application
20120246300
This application is based upon and claims the benefit of priority of the prior Japanese Patent Application No. 2011-63399, filed on Mar. 22, 2011, the entire contents of which are incorporated herein by reference.
The embodiments discussed herein are related to an analyzing apparatus, an analyzing program, an analyzing method, and a system.
There has been a technique for analyzing the call relationship of the communication of a request-response in a system including an apparatus that transmits, in response to a received request, a request corresponding to the received request to another apparatus and further returns a response corresponding to a response received from another apparatus.
In the technique of the related art, when a model creation instruction is input, a transaction model satisfying the constraint condition of a call between servers is created on the basis of a message set selected in accordance with a selection criterion based on the possibility of a call relationship between processing operations. In addition, when an analysis instruction is input, the processing state of a transaction is analyzed on the basis of a protocol log meeting the transaction model.
In the above-mentioned technique of the related art, in order to associate the logs of communication, which have a call relationship, with each other, a preliminarily defined model is used. However, for example, owing to the specification change of the system or the like, performed after the model creation, a case occurs in which a request and a request called by the former request have not been defined in the preliminarily defined model. Therefore, it may be difficult to associate the logs of communication including the requests, respectively, with each other.
According to an aspect of the invention, an analyzing apparatus includes a memory and a processor that executes a procedure, the procedure including controlling the memory to store logs of communication between a first apparatus and a second apparatus, and logs of communication between the second apparatus and a third apparatus, and extracting logs indicating a pair of a first request and a first response corresponding to the first request, communicated between the second apparatus and the third apparatus within a time range from transmission of a second request, transmitted from the first apparatus to the second apparatus, to transmission of a second response corresponding to the second request, transmitted from the second apparatus to the first apparatus, from among the logs stored in the memory.
The object and advantages of the invention will be realized and attained by means of the elements and combinations particularly pointed out in the claims.
It is to be understood that both the foregoing general description and the following detailed description are exemplary and explanatory and are not restrictive of the invention, as claimed.
Preferred embodiments of the present technology will be explained with reference to accompanying drawings.
A system according to a first embodiment will be described.
A first apparatus 11 is an apparatus for making a service request to the service providing system 15. For example, the first apparatus 11 is coupled to the Internet 16. On receiving the operation of a user, the first apparatus 11 transmits, to the Internet 16, the request message of a hypertext transfer protocol (HTTP), used for requesting a service. In this case, the first apparatus 11 transmits, to the Internet 16, a request message whose transmission destination is a second apparatus 12 described later. In addition, the first apparatus 11 receives a response from the second apparatus 12. For example, the first apparatus 11 receives the response message of an HTTP from the second apparatus 12. In addition, the first apparatus 11 displays the content of the response message in a browser. As an example of the first apparatus 11, a client terminal used by the user, or the like, may be cited. In addition, while, in the example of
In the Internet 16, data is transmitted to an apparatus serving as a transmission destination. For example, in the Internet 16, a request message, which is a request message transmitted from the first apparatus 11 and whose transmission destination is the second apparatus 12, is transmitted to the switch 14 coupled to the second apparatus 12. In addition, in the Internet 16, a response message, which is a response message transmitted from the switch 14 and whose transmission destination is the first apparatus 11, is transmitted to the first apparatus 11.
The service providing system 15 provides a service in response to a request from the user. For example, the service providing system 15 includes the second apparatus 12 and a third apparatus 13.
In response to a request from the first apparatus 11, the second apparatus 12 transmit a request to the third apparatus 13. For example, in response to a request message from the first apparatus 11, which requests a service, the second apparatus 12 transmits the query of a structured query language (SQL) to the third apparatus 13.
In addition, in response to a response from the third apparatus 13, the second apparatus 12 transmits a response to the first apparatus 11. For example, in response to the response of an SQL from the third apparatus 13, the second apparatus 12 transmits the response message of an HTTP to the first apparatus 11. As an example of the second apparatus, a Web server or the like may be cited. In addition, while, in the example of
In response to a request from the second apparatus 12, the third apparatus 13 transmits a response to the second apparatus 12. For example, in response to the query of an SQL from the second apparatus 12, the third apparatus 13 accesses a DB not illustrated, and transmits the response of an SQL to the second apparatus 12. As an example of the third apparatus, a DB server or the like may be cited. In addition, while, in the example of
The switch 14 transmits and receives data between individual apparatuses including the first apparatus 11, the second apparatus 12, and the third apparatus 13, and transmits a copy of data flowing between the individual apparatuses, to the analyzing apparatus 10. In the example of
In addition, the switch 14 includes a so-called port mirroring function. For example, the switch 14 copies data going through the ports P1, P2, and P3, and transmits the copied data from the port P4 to the analyzing apparatus 10. Accordingly, it may be possible for the analyzing apparatus 10 to collect data flowing between the individual apparatuses including the first apparatus 11, the second apparatus 12, and the third apparatus 13. The switch 14 may correspond to a plurality of apparatuses, and be configured by an apparatus relaying communication between the first apparatus 11 and the second apparatus 12 and an apparatus relaying communication between the second apparatus 12 and the third apparatus 13, for example.
The analyzing apparatus 10 includes a first detection unit 10a, a second detection unit 10b, a calculation unit 10c, and an extraction unit 10d. On the basis of data flowing between the first apparatus 11 and the second apparatus 12, the first detection unit 10a detects a first pair of a request and a response between the first apparatus 11 and the second apparatus 12. As an example of the first pair, a request message, transmitted from the first apparatus 11 to the second apparatus 12, and a response message, which correspond to the request message and is transmitted from the second apparatus 12 to the first apparatus 11, may be cited. On the basis of data flowing between the second apparatus 12 and the third apparatus 13, the second detection unit 10b detects a second pair of a request and a response between the second apparatus 12 and the third apparatus 13. As an example of the second pair, the query of an SQL, transmitted from the second apparatus 12 to the third apparatus 13, and the response of an SQL, which corresponds to this query of an SQL and is transmitted from the third apparatus 13 to the second apparatus 12, may be cited. On the basis of the first pair detected in the first detection unit 10a and the second pair detected in the second detection unit 10b, the calculation unit 10c calculates the probability that the second pair exists between a request and a response in the first pair. On the basis of the probability calculated in the calculation unit 10c, the extraction unit 10d extracts a second pair corresponding to a given first pair. As an example of the given first pair, a first pair may be cited that is considered to be in a malfunctioning state in which a time from a request to a response has exceeded a given threshold value. In addition, a user such as the administrator of the system 1, or the like, may try to confirm the situation of such a given first pair.
As described above, the analyzing apparatus 10 according to the present embodiment calculates the probability that the second pair exists between a request and a response in the first pair, and, extracts a second pair corresponding to a given first pair on the basis of the calculated probability. In such a way as described above, on the basis of the probability, the analyzing apparatus 10 according to the present embodiment extracts the second pair corresponding to the given first pair without using a model preliminarily defining pieces of information associated with each other. Accordingly, even if a correspondence between a new first pair and a new second pair occurs owing to the specification change of the system or the like, it may be possible for the analyzing apparatus 10 according to the present embodiment to associate the new first pair with the new second pair. Accordingly, according to the analyzing apparatus 10 according to the present embodiment, it may be possible to more desirably associate pieces of relevant information with each other.
In addition, the analyzing apparatus 10 according to the present embodiment acquires the logs of communication in the system including the first apparatus 11, the second apparatus 12, and the third apparatus 13. In addition, from among the acquired logs, the analyzing apparatus 10 according to the present embodiment performs the following processing within a time range from a time when a request is transmitted from the first apparatus 11 to the second apparatus 12 to a time when a response corresponding to the request is transmitted from the second apparatus 12 to the first apparatus 11. Namely, the analyzing apparatus 10 extracts a log indicating a pair of a request and a response, communicated between the second apparatus 12 and the third apparatus 13. For example, within a given time range within which a request and a response are communicated more than once, the analyzing apparatus 10 according to the present embodiment calculates, with respect to each type, the probability that each of plural types of pairs of requests and responses, communicated between the second apparatus 12 and the third apparatus 13, has been communicated within a response time range of the request and response communicated more than once. In addition, with respect to a pair of a request and a response, communicated within a response time range relating to one of the request and response communicated more than once, the analyzing apparatus 10 according to the present embodiment generates a plurality of combination patterns of the types of pairs of requests and responses. In addition, the analyzing apparatus 10 according to the present embodiment selects one of the plural combination patterns on the basis of the degree of similarity with the calculated probability of each type. Accordingly, according to the analyzing apparatus 10 according to the present embodiment, it may be possible to sequentially associate communication logs having a call relationship with each other, with respect to the acquired communication logs.
Next, a second embodiment will be described. In the present embodiment, a case will be described in which a capture server is adopted as an example of the analyzing apparatus. In addition, in the present embodiment, a case will be described in which a client terminal is adopted as an example of the first apparatus. In addition, in the present embodiment, a case will be described in which a Web server is adopted as an example of the second apparatus. In addition, in the present embodiment, a case will be described in which a DB server is adopted as an example of the third apparatus.
The capture server according to the second embodiment will be described.
The input unit 26 inputs information to the control unit 25. For example, on receiving an instruction from a user, the input unit 26 inputs, to the control unit 25, an instruction for executing extraction processing described later. Examples of information included in the instruction include a given first pair, the situation of which the user tries to confirm. As an example of the device of the input unit 26, a keyboard, a mouse, or the like may be cited.
The I/F 27 is a communication interface used for performing communication with the switch 14 and the control unit 25. For example, when having received a copy of a request message that is a copy of a request message transmitted from the switch 14 and a copy of a request message from the client terminal 21 to the Web server 22, the I/F 27 transmits the received copy of a request message to the control unit 25. In addition, when having received a copy of the query of an SQL that is a copy of the query of an SQL transmitted from the switch 14 and a copy of the query of an SQL from the Web server 22 to the DB server 23, the I/F 27 transmits the received copy of the query of an SQL to the control unit 25. In addition, when having received a copy of the response of an SQL that is a copy of the response of an SQL transmitted from the switch 14 and a copy of the response of an SQL from the DB server 23 to the Web server 22, the I/F 27 transmits the received copy of the response of an SQL to the control unit 25. In addition, when having received a copy of a response message that is a copy of a response message transmitted from the switch 14 and a copy of a response message from the Web server 22 to the client terminal 21, the I/F 27 performs the following processing. Namely, the I/F 27 transmits the received copy of a response message to the client terminal 21.
The annunciation unit 28 annunciates information. For example, the annunciation unit 28 annunciates a given number of correspondence relationships between first pairs and second pairs, whose scores are input by an annunciation control unit 25f described later and high. As the device of the annunciation unit 28, for example, a cathode ray tube (CRT), a liquid crystal display, or the like may be cited.
The storage unit 24 stores therein various kinds of programs to be executed in the control unit 25. In addition, the storage unit 24 stores therein a pair list 24a, a first number-of-times table 24b, a second number-of-times table 24c, a degree table 24d, a probability table 24e, and a degree-of-importance table 24f.
The pair list 24a is a table in which a pair of a request and a response correspond to the request are registered. In each record of the pair list 24a, each pair of a request and a response is registered by a first detection unit 25b and a second detection unit 25c, described later.
In addition, the example of
Here, in the example of
In addition, in the example of
In addition, information registered in the pair list 24a is not limited to the above-mentioned contents. Information available for associating the first pair and the second pair with each other may just be registered in the pair list 24a. For example, the information registered in the pair list 24a may just include the “request time”, the “response time”, the “layer”, and the “content 1”. In addition, an analysis unit 25a described later analyses data from the switch 14, and hence the information of each item registered in the pair list 24a is obtained.
The first number-of-times table 24b is a table in which the number of times the first pair has emerged in data from the switch 14 is registered with respect to each type. In the first number-of-times table 24b, the number of times the first pair has emerged, calculated by a calculation unit 25d described later, is updated with respect to each type.
The second number-of-times table 24c is a table in which the number of times the second pair has emerged within a time between the request and response of the first pair is registered. In the second number-of-times table 24c, the number of times the second pair has emerged within a time between the request and response of the first pair is updated by the calculation unit 25d. In the former example of
The degree table 24d is a table in which the degree of a possibility to include the second pair is registered with respect to each type of the first pair. The degree registered in the degree table 24d is updated by the calculation unit 25d. In the former example of
The probability table 24e is a table in which the probability that the first pair includes the second pair is registered. The probability registered in the probability table 24e is updated by the calculation unit 25d. In addition, by dividing each of the numbers of times the second pairs have emerged, registered in the second number-of-times table 24c, by each of the corresponding degrees registered in the degree table 24d, the calculation unit 25d described later calculates the probability that the first pair includes the second pair.
The degree-of-importance table 24f is a table in which the degree of importance is registered. Here, an example of the degree of importance will be described. For example, the degree of importance between a first pair and a second pair increases with an increase in the degree of a possibility that the first pair includes the second pair, and the degree of importance between a first pair and a second pair decreases with an increase in the number of the types of first pairs that may include the second pair. In addition, the degree of importance between a second pair and the “batch processing” increases with an increase in the degree of a possibility that the second pair occurs owing to the batch processing. In the degree-of-importance table 24f, an extraction unit 25e described later registers the degree of importance.
For example, the extraction unit 25e described later uses the degree of importance registered in the degree-of-importance table 24f, as the feature vector of the “batch processing”, the feature vector of the “pair 1”, the feature vector of the “pair 2”, . . . , and the feature vector of a pair N. The example of
For example, the storage unit 24 is a semiconductor memory device such as a flash memory or the like, or a storage apparatus such as a hard disk, an optical disk, or the like. In addition, the storage unit 24 is not limited to the storage apparatuses of the above-mentioned types, and may also be a random access memory (RAM) or a read only memory (ROM).
Returning to the description of
The analysis unit 25a analyses data. For example, the analysis unit 25a stores, in the storage unit 24, data that is transmitted from the switch 14 and whose amount corresponds to a given time, for example, data whose amount corresponds to 30 seconds, and repeatedly performs, on the stored data, processing for performing analysis described later, with respect to each given time.
An example of the analysis will be described that is performed by the analysis unit 25a. The analysis unit 25a analyses a copy of a request message transmitted from the client terminal 21 to the Web server 22, and acquires the content of a request included in the request message. For example, with respect to a request message such as “http://www.server.com/job/type.jsp”, the analysis unit 25a analyses that the request message is a request message for requesting a content, specified by the path notation of “/job/type.jsp”, from a server indicated by “www.server.com”. In addition, the analysis unit 25a analyses a copy of the query of an SQL transmitted from the Web server 22 to the DB server 23, and acquires the content of a query included in the query of an SQL. In addition, the analysis unit 25a acquires a time when a copy of the request message has been received. In addition, the analysis unit 25a acquires a time when a copy of the query of an SQL has been received.
In addition, the analysis unit 25a analyses a copy of a response message transmitted from the Web server 22 to the client terminal 21, and acquires the content of a response included in the response message. In addition, the analysis unit 25a analyses a copy of the response message, and acquires the IP address of a transmission source included in the response message. In addition, the analysis unit 25a analyses a copy of the response message, and acquires the IP address of a transmission destination included in the response message. In addition, the analysis unit 25a analyses a copy of the response of an SQL transmitted from the DB server 23 to the Web server 22, and acquires the content of a response included in the response of an SQL. In addition, the analysis unit 25a analyses a copy of the response of an SQL, and acquires the IP address of a transmission source included in the response of an SQL. In addition, the analysis unit 25a analyses a copy of the response of an SQL, and acquires the IP address of a transmission destination included in the response of an SQL. In addition, the analysis unit 25a acquires a time when a copy of the response message has been received. In addition, the analysis unit 25a acquires a time when a copy of the response of an SQL has been received.
The first detection unit 25b detects a first pair of a request and a response between the client terminal 21 and the Web server 22. For example, the first detection unit 25b associates a request message and a response message with each other, on the basis of the content of the request message and the content of the response message, analyzed by the analysis unit 25a. The term “associate” here is also called pairing, and indicates to associate a request message and a response message corresponding to the request message with each other.
In addition, the first detection unit 25b registers, in the pair list 24a, the first pair of the request message and the response message, associated with each other. In addition, as illustrated in
The second detection unit 25c detects a second pair of a request and a response between the Web server 22 and the DB server 23. For example, the second detection unit 25c associates the query of an SQL and the response of an SQL with each other, on the basis of the content of the query of an SQL and the content of the response of an SQL, analyzed by the analysis unit 25a. The term “associate” here indicates to associate a query of an SQL and a response of an SQL corresponding to the query of an SQL with each other.
In addition, the second detection unit 25c registers, in the pair list 24a, a second pair of the query of an SQL and the response of an SQL, associated with each other. In addition, as illustrated in
On the basis of the first pair detected in the first detection unit 25b and the second pair detected in the second detection unit 25c, the calculation unit 25d calculates the probability that the second pair exists between a request and a response in the first pair.
For example, first, the calculation unit 25d calculates the number of the first pairs detected by the first detection unit 25b, with respect to each type. In addition, the calculation unit 25d adds the calculated number of the first pairs to a corresponding item in the first number-of-times table 24b. Accordingly, the registration content of the first number-of-times table 24 is updated.
In addition, the calculation unit 25d calculates the number of times the second pair has emerged between a request of the first pair and a response thereof.
In addition, the calculation unit 25d calculates the degree of a possibility to include the second pair, with respect to each of the types of the first pairs. For example, when, with respect to a certain second pair, the number of first pairs that may include this second pair is “N”, the calculation unit 25d adds a value of “1/N” to the degree of each of the N first pairs for this second pair.
In addition, the calculation unit 25d calculates the probability that the first pair includes the second pair. For example, by dividing each of the numbers of times the second pairs have emerged, registered in the second number-of-times table 24c, by each of the corresponding degrees registered in the degree table 24d, the calculation unit 25d calculates the probability that the first pair includes the second pair. When the registration content of the second number-of-times table 24c corresponds to a content illustrated in
The extraction unit 25e extracts a second pair corresponding to a given first pair on the basis of the calculated probability. For example, when an instruction for executing extraction processing has been input from the input unit 26, the extraction unit 25e performs processing described below. Namely, first, the extraction unit 25e calculates the degree of importance used for extracting a characteristic second pair included in the first pair.
Here, an example of a calculation method for the degree of importance performed in the extraction unit 25e will be described. The extraction unit 25e calculates the degree of importance I with respect to each second pair for the first pair, in accordance with the following Expression (1).
I=tf×log(N/df) Expression (1)
In this regard, however, the “tf” is the degree of a possibility that the first pair registered in the degree table 24d includes the second pair. In addition, the “N” is the sum of the numbers of times the first pairs registered in the first number-of-times table 24b have emerged. In addition, the “df” is the number of first pairs where the probabilities that the first pairs include a second pair are greater than “0”, the probabilities being registered in the probability table 24e. It may be possible for the extraction unit 25e to obtain such a number of the first pairs on the basis of the following processing. Namely, the types of first pairs are specified where the probabilities that the first pairs include a second pair, registered in the probability table 24e, are greater than “0”, and the sum of the numbers of first pairs of the specified types is calculated from among first pairs where the numbers of times the first pairs have emerged are registered in the first number-of-times table 24b.
In addition, in the degree-of-importance table 24f, the extraction unit 25e registers the degree of importance I calculated with respect to each second pair for a first pair, with respect to each second pair for the first pair.
In addition, on the basis of the registration content of the pair list 24a, the extraction unit 25e extracts a second pair included in a first pair the situation of which the user tries to confirm, the first pair being included in the instruction for executing the extraction processing.
For example, in the example of
In addition, the extraction unit 25e registers the extracted second pairs in a “child candidate list”.
In addition, on the basis of the registration content of the pair list 24a, the extraction unit 25e extracts a first pair that may include a second pair registered in the “child candidate list”. For example, in the example of
In addition, the extraction unit 25e registers the extracted first pairs in a “parent candidate list”.
In addition, the extraction unit 25e calculates feature vectors relating to the first pair registered in the parent candidate list and the “batch processing”. For example, the extraction unit 25e calculates the degree of importance of the first pair registered in the degree-of-importance table 24f and the degree of importance of “batch processing” as the feature vectors thereof, respectively. Here, a specific example will be cited and described. When, as illustrated in the example of
In addition, the extraction unit 25e calculates all the combinations of the second pairs registered in the child candidate list, the first pairs registered in the parent candidate list, and the “batch processing”. In this regard, however, the extraction unit 25e does not calculate the combination of a second pair and a first pair that may not include this second pair. An example of a calculation method for the combinations performed by the extraction unit 25e will be described. In the example of
In addition, the extraction unit 25e calculates the feature vector of each of the calculated combinations. For example, with respect to each of the first pairs, the extraction unit 25e calculates a feature vector in which the element of a included second pair is “1” and the element of a second pair not included is “0”. Here, a specific example will be cited, and an example of a calculation method for the feature vector of a combination, performed by the extraction unit 25e, will be described.
In addition, in the combination in which the SQLs-b, c, and e are associated with the “pair 1” and the SQL-f is associated with the “pair 2”, the extraction unit 25e calculates a feature vector (0, 1, 1, 0, 1, 0, 0, 0) with respect to the “pair 1”, as illustrated in the example of
In addition, in the combination in which the SQLs-b, e, and f are associated with the “pair 1” and the SQL-c is associated with the “pair 2”, the extraction unit 25e calculates a feature vector (0, 1, 0, 0, 1, 1, 0, 0) with respect to the “pair 1”, as illustrated in the example of
In addition, with respect to each of the combinations, the extraction unit 25e calculates the degree of similarity between each of the feature vector of the first pair and the feature vector of the “batch processing” and the calculated feature vector of the combination. In addition, while, as for a calculation method for the degree of similarity between vectors, there are various kinds of methods, an algorithm may be adopted that calculates the degree of cosine similarity, for example.
In addition, the extraction unit 25e calculates, as a score, the sum of the calculated degrees of similarity, with respect to the individual combinations.
Returning to the description of
The control unit 25 is an integrated circuit such as an application specific integrated circuit (ASIC), a field programmable gate array (FPGA), or the like, or an electronic circuit such as a central processing unit (CPU), a micro processing unit (MPU), or the like.
Next, the flow of the processing of the capture server 20 according to the present embodiment will be described.
As illustrated in
The calculation unit 25d calculates the number of the detected first pairs with respect to each type, adds the calculated number of the first pairs to a corresponding item in the first number-of-times table 24b, and updates the registration content of the first number-of-times table 24 (S104). The calculation unit 25d calculates the number of times the second pair has emerged between a request of the first pair and a response thereof, adds the calculated number of times the second pair has emerged, to a corresponding item in the second number-of-times table 24c, with respect to each type, and updates the registration content of the second number-of-times table 24c (S105).
The calculation unit 25d calculates the degree of a possibility to include the second pair, with respect to each of the types of the first pairs, adds the calculated degree of a possibility to a corresponding item in the degree table 24d, and updates the registration content of the degree table 24d (S106). The calculation unit 25d calculates the probability that the first pair includes the second pair, registers the calculated probability in the probability table 24e, updates the registration content of the probability table 24e (S107), and terminates the processing.
As illustrated in
On the basis of the registration content of the pair list 24a, the extraction unit 25e extracts a first pair that may include a second pair registered in the “child candidate list” (S204). The extraction unit 25e registers the extracted first pair in the “parent candidate list” (S205).
The extraction unit 25e calculates feature vectors relating to the first pair registered in the parent candidate list and the “batch processing” (S206). The extraction unit 25e calculates all the combinations of the second pairs registered in the child candidate list, the first pairs registered in the parent candidate list, and the “batch processing” (S207). The extraction unit 25e calculates the feature vector of each of all the calculated combinations (S208). With respect to each of all the combinations, the extraction unit 25e calculates the degree of similarity between each of the feature vector of the first pair and the feature vector of the “batch processing” and the calculated feature vector of the combination (S209). The extraction unit 25e calculates, as a score, the sum of the degrees of similarity calculated with respect to the individual combinations (S210). The annunciation control unit 25f controls the annunciation unit 28 so as to annunciate a given number of correspondence relationships between first pairs and second pairs, whose scores are high, for example, whose scores are top three scores (S211), and terminates the processing.
As described above, the capture server 20 according to the present embodiment calculates the probability that the second pair exists between a request and a response in the first pair, and extracts the second pair corresponding to a given first pair, on the basis of the calculated probability. In this way, on the basis of the probability, the capture server 20 according to the present embodiment extracts the second pair corresponding to the given first pair without using a model preliminarily defining pieces of information associated with each other. Accordingly, even if a correspondence between a new first pair and a new second pair occurs owing to the specification change of the system or the like, it may be possible for the capture server 20 according to the present embodiment to associate the new first pair and the new second pair with each other. Accordingly, according to the capture server 20 according to the present embodiment, it may be possible to more desirably associate pieces of relevant information with each other.
In addition, the capture server 20 according to the present embodiment acquires the logs of communication in the system including the first apparatus 11, the second apparatus 12, and the third apparatus 13. In addition, from among the acquired logs, the capture server 20 according to the present embodiment performs the following processing within a time range from a time when a request is transmitted from the first apparatus 11 to the second apparatus 12 to a time when a response corresponding to the request is transmitted from the second apparatus 12 to the first apparatus 11. Namely, the capture server 20 extracts a log indicating a pair of a request and a response, communicated between the second apparatus 12 and the third apparatus 13. For example, within a given time range within which a request and a response are communicated more than once, the capture server 20 according to the present embodiment calculates, with respect to each type, the probability that each of plural types of pairs of requests and responses, communicated between the second apparatus 12 and the third apparatus 13, has been communicated within a response time range of the request and response communicated more than once. In addition, with respect to a pair of a request and a response, communicated within a response time range relating to one of the request and response communicated more than once, the capture server 20 according to the present embodiment generates a plurality of combination patterns of the types of pairs of requests and responses. In addition, the capture server 20 according to the present embodiment selects one of the plural combination patterns on the basis of the degree of similarity with the calculated probability of each type. Accordingly, according to the capture server 20 according to the present embodiment, it may be possible to sequentially associate communication logs having a call relationship with each other, with respect to the acquired communication logs.
In addition, on the basis of the probability and the combination of second pairs that have existed between a request and a response in a given first pair included in an instruction for the extraction processing, the capture server 20 according to the present embodiment extracts a second pair corresponding to the given first pair. In this way, the capture server 20 according to the present embodiment associates the first pair and the second pair with each other on the basis of the combination of second pairs that have existed between a request and a response in the given first pair. Namely, when such associating is performed, the combination of second pairs is not considered that has existed between a request and a response in a first pair whose request or response has existed between a request and a response in the given first pair. Therefore, according to the capture server 20 according to the present embodiment, compared with a case in which such information is considered, it may be possible to associate the first pair and the second pair with each other using simple processing. In addition, within a given time range within which a request and a response are communicated more than once, the capture server 20 according to the present embodiment calculates, with respect to each type, the probability that each of plural types of pairs of requests and responses, communicated between the second apparatus 12 and the third apparatus 13, has been communicated within a response time range of the request and response communicated more than once. In addition, with respect to a pair of a request and a response, communicated within a response time range relating to one of the request and response communicated more than once, the capture server 20 according to the present embodiment generates a plurality of combination patterns of the types of pairs of requests and responses. In addition, the capture server 20 according to the present embodiment selects one of the plural combination patterns on the basis of the degree of similarity with the calculated probability of each type.
Incidentally, while, in the above-mentioned second embodiment, a case has been exemplified in which the first pair and the second pair is associated with each other on the basis of the combination of second pairs that have existed between a request and a response in a given first pair, the disclosed apparatus is not limited to the case. Therefore, in a third embodiment, a case will be described where the combination of second pairs is considered that has existed between a request and a response in a first pair whose request or response has existed between a request and a response in the given first pair.
The extraction unit 65e has the same function as that of the extraction unit 25e according to the second embodiment, and, in addition to this, performs processing described hereinafter.
On the basis of the registration content of the pair list 24a, the extraction unit 65e extracts a second pair included in a first pair the situation of which the user tries to confirm, the first pair being included in the instruction for executing the extraction processing. In addition, on the basis of the registration content of the pair list 24a, the extraction unit 65e extracts a second pair that has existed between a request and a response in a first pair whose request or response has existed between a request and a response in a given first pair. In addition, it may be possible to limit the second pair extracted in such a way to a second pair whose request and response have been transmitted and received between the same apparatuses as apparatuses between which the request and the response of the given first pair have been transmitted and received.
For example, in the example of
In addition, the extraction unit 65e registers the extracted second pairs in a “child candidate list”.
In addition, on the basis of the registration content of the pair list 24a, the extraction unit 65e extracts a first pair that may include a second pair registered in the “child candidate list”. For example, in the example of
In addition, the extraction unit 65e registers the extracted first pairs in a “parent candidate list”.
In addition, in the same way as the extraction unit 25e according to the second embodiment, the extraction unit 65e calculates feature vectors relating to the first pair registered in the parent candidate list and the “batch processing”.
In addition, the extraction unit 65e calculates all the combinations of the second pairs registered in the child candidate list, the first pairs registered in the parent candidate list, and the “batch processing”. In this regard, however, the extraction unit 65e does not calculate the combination of a second pair and a first pair that may not include this second pair. An example of a calculation method for the combinations performed by the extraction unit 65e will be described. In the example of
In addition, in the same as the extraction unit 25e according to the second embodiment, the extraction unit 65e calculates the feature vector of each of the calculated combinations. For example, with respect to each of the first pairs, the extraction unit 65e calculates a feature vector in which the element of a included second pair is “1” and the element of a second pair not included is “0”. Here, a specific example will be cited, and an example of a calculation method for the feature vector of a combination, performed by the extraction unit 65e, will be described.
In addition, in the combination in which the SQLs-b, c, and e are associated with the “pair 1” and the SQLs-d, f, and d are associated with the “pair 2”, the extraction unit 65e calculates a feature vector (0, 1, 1, 0, 1, 0, 0, 0) with respect to the “pair 1”, as illustrated in the example of
In addition, in the combination in which the SQLs-b, e, and f are associated with the “pair 1” and the SQLs-c, d, and g are associated with the “pair 2”, the extraction unit 65e calculates a feature vector (0, 1, 0, 0, 1, 1, 0, 0) with respect to the “pair 1”, as illustrated in the example of
In addition, in the same way as the extraction unit 25e according to the second embodiment, with respect to each of the combinations, the extraction unit 65e calculates the degree of similarity between each of the feature vector of the first pair and the feature vector of the “batch processing” and the calculated feature vector of the combination.
In addition, the extraction unit 65e calculates, as a score, the sum of the calculated degrees of similarity, with respect to the individual combinations.
The control unit 65 is an integrated circuit such as an application specific integrated circuit (ASIC), a field programmable gate array (FPGA), or the like, or an electronic circuit such as a central processing unit (CPU), a micro processing unit (MPU), or the like.
Next, the flow of the processing of the capture server 60 according to the present embodiment will be described. In addition, since learning processing according to the present embodiment is the same as the learning processing according to the second embodiment, the description thereof will be omitted.
As illustrated in
As described above, the capture server 60 according to the present embodiment calculates the probability that the second pair exists between a request and a response in the first pair, and extracts a second pair corresponding to the given first pair on the basis of the calculated probability. In such a way as described above, on the basis of the probability, the capture server 60 according to the present embodiment extracts the second pair corresponding to the given first pair without using a model preliminarily defining pieces of information associated with each other. Accordingly, even if a correspondence between a new first pair and a new second pair occurs owing to the specification change of the system or the like, it may be possible for the capture server 60 according to the present embodiment to associate the new first pair and the new second pair with each other. Accordingly, according to the capture server 60 according to the present embodiment, it may be possible to more desirably associate pieces of relevant information with each other.
In addition, the capture server 60 according to the present embodiment acquires the logs of communication in the system including the first apparatus 11, the second apparatus 12, and the third apparatus 13. In addition, from among the acquired logs, the capture server 60 according to the present embodiment performs the following processing within a time range from a time when a request is transmitted from the first apparatus 11 to the second apparatus 12 to a time when a response corresponding to the request is transmitted from the second apparatus 12 to the first apparatus 11. Namely, the capture server 60 extracts a log indicating a pair of a request and a response, communicated between the second apparatus 12 and the third apparatus 13. For example, within a given time range within which a request and a response are communicated more than once, the capture server 60 according to the present embodiment calculates, with respect to each type, the probability that each of plural types of pairs of requests and responses, communicated between the second apparatus 12 and the third apparatus 13, has been communicated within a response time range of the request and response communicated more than once. In addition, with respect to a pair of a request and a response, communicated within a response time range relating to one of the request and response communicated more than once, the capture server 60 according to the present embodiment generates a plurality of combination patterns of the types of pairs of requests and responses. In addition, the capture server 60 according to the present embodiment selects one of the plural combination patterns on the basis of the degree of similarity with the calculated probability of each type. Accordingly, according to the capture server 60 according to the present embodiment, it may be possible to sequentially associate communication logs having a call relationship with each other, with respect to the acquired communication logs.
In addition, in addition to the probability or the like, furthermore, on the basis of the following information, the capture server 60 according to the present embodiment extracts a second pair corresponding to a given first pair. Namely, in the present embodiment, associating the first pair and the second pair with each other is performed on the basis of the combination of second pairs that have existed between a request and a response in a first pair whose request or response has existed between a request and a response in a given first pair. Namely, when such associating is performed, the combination of second pairs is considered that has existed between a request and a response in a first pair whose request or response has existed between a request and a response in a given first pair. Therefore, according to the capture server 60 according to the present embodiment, compared with a case in which such information is not considered, it may be possible to perform the associating with a higher degree of accuracy.
Incidentally, while the embodiments relating to the disclosed apparatus have so far been described, the present technology may be implemented in various different forms, in addition to the above-mentioned embodiments. Therefore, hereinafter, other embodiments included in the present technology will be described.
For example, individual apparatuses in the system to which the present technology is applied are not limited to the above-mentioned first apparatus to third apparatus, and the present technology is also applied to a system including a plurality of apparatuses.
In addition, from among the individual processing operations described in the second and third embodiments, all or part of a processing operation described to be automatically performed may also be manually performed. For example, the user or the like may input an execution instruction for each processing through an operation reception apparatus not illustrated.
In addition, in response to various kinds of loads or usage situations, it may be possible to arbitrarily subdivide or bring together processing operations in each processing described in each embodiment. In addition, it may also be possible to omit an operation. For example, it may also be possible to bring together S302 and S401, illustrated in
In addition, in response to various kinds of loads or usage situations, it may be possible to change the order of processing operations in each processing described in each embodiment. For example, it may also be possible to interchange the order of S302 and S401 illustrated in
In addition, each configuration element in each apparatus illustrated is a functional and conceptual element, and may not be physically configured as illustrated. Namely, the specific state of the distribution or integration of the individual apparatuses is not limited to one of examples illustrated in drawings, and all or part of the individual apparatuses may be functionally or physically integrated or distributed in arbitrary units according to various kinds of loads or usage situations. For example, the analysis unit 25a and the first detection unit 25b may be integrated, and it may be possible to configure a new first detection unit.
In addition, various kinds of processing operations of the analyzing apparatus or the capture server described in the above-mentioned embodiment may also be realized by executing a preliminarily prepared program in a computer system such as a personal computer, a workstation, or the like. Therefore, hereinafter, using
The communication interface 350 is used for acquiring the log of communication in the system including the first apparatus 11, the second apparatus 12, and the third apparatus 13. For example, the communication interface 350 is coupled to the port P4 of the above-mentioned switch 14. In this case, the communication interface 350 acquires, from the switch 14, the log of communication in the system including the first apparatus 11, the second apparatus 12, and the third apparatus 13.
In the ROM 320, a analyzing program 320a is preliminarily stored that fulfills the same functions as those of the analysis unit, the first detection unit, the second detection unit, the calculation unit, the extraction unit, and the annunciation control unit, illustrated in one of the above-mentioned first to third embodiments. In addition, the analyzing program 320a may also be arbitrarily separated. For example, the analyzing program 320a may also be separated into a program fulfilling the same functions as those of the analysis unit and the annunciation control unit and a program fulfilling the same functions as those of the first detection unit, the second detection unit, the calculation unit, and the extraction unit.
In addition, the CPU 310 is an example of a processor that reads out and executes the analyzing program 320a from the ROM 320. The processor is a hardware to carry out operations based on at least one program (such as the analyzing program) and control other hardware, such as the CPU 310, a GPU (Graphics Processing Unit), FPU (Floating point number Processing Unit) and DSP (Digital signal Processor).
In addition, in the HDD 330, a pair list, a first number-of-times table, a second number-of-times table, a degree table, a probability table, and a degree-of-importance table are provided. The pair list, the first number-of-times table, and the second number-of-times table correspond to the pair list 24a, the first number-of-times table 24b, and the second number-of-times table 24c, respectively. In addition, the degree table, the probability table, and the degree-of-importance table correspond to the degree table 24d, the probability table 24e, and the degree-of-importance table 24f, respectively.
In addition, the CPU 310 reads out and stores the pair list, the first number-of-times table, the second number-of-times table, the degree table, the probability table, and the degree-of-importance table in the RAM 340. Furthermore, the CPU 310 executes the analyzing program using the pair list, the first number-of-times table, the second number-of-times table, the degree table, the probability table, and the degree-of-importance table, stored in the RAM 340. In addition, all of individual pieces of data stored in the RAM 340 may not be continuously stored in the RAM 340, and a piece of data used for processing may be stored in the RAM 340, from among all of the individual pieces of data.
In addition, the above-mentioned analyzing program may not be caused to be stored in the ROM 320 from the beginning.
For example, the program is caused to be stored in a “portable physical medium” to be inserted into the computer 300, such as a flexible disk (FD), a CD-ROM, a DVD disk, a magneto-optical disk, an IC card, or the like. In addition, the computer 300 may also read out and execute the program from one of these media.
Furthermore, the program is caused to be stored in “another computer (or server)” coupled to the computer 300 through a public line, Internet, a LAN, a WAN, or the like. In addition, the computer 300 may also read out and execute the program from one of these.
In addition, each of the first apparatus 11, the second apparatus 12, the third apparatus 13, the client terminal 21, the Web server 22, and the DB server 23 may be an apparatus having the hardware configuration illustrated in
According to the above-mentioned embodiments, it may be possible to sequentially associate communication logs having a call relationship with each other, with respect to the acquired communication logs.
All examples and conditional language recited herein are intended for pedagogical purposes to aid the reader in understanding the invention and the concepts contributed by the inventor to furthering the art, and are to be construed as being without limitation to such specifically recited examples and conditions, nor does the organization of such examples in the specification relate to a showing of the superiority and inferiority of the invention. Although the embodiments of the present invention have been described in detail, it should be understood that the various changes, substitutions, and alterations could be made hereto without departing from the spirit and scope of the invention.
| Number | Date | Country | Kind |
|---|---|---|---|
| 2011-063399 | Mar 2011 | JP | national |
