Dynatrace Patente

A computer-implemented method is presented for extracting data from textual records. The objective of the disclosure is to identify the most appropriate pattern in a set of patterns for extracting data from data records and by applying the most appropriate pattern to a plurality of data records, to robustly extract data from textual records.

A unified storage format is presented for received observation data records of various formats, including individual observations or histograms and pre-sampled records describing multiple observations. The proposed storage format also supports various data reduction technologies, including coarsening of time and observation value resolutions, where the proposed data reduction technologies retain data describing the quantity of observations. In addition, sampling-based data reduction approaches are described, which at least retain the statistical expectancy value for the number of observations. Further, a definition and storage format for histogram buckets is provided with guaranteed relative error behavior over the whole value range of observation data, that only requires the definition of a number of significant bits for the recording and interpretation of histogram data. The proposed histogram storage scheme is applicable to integer and floating-point observation data. (Fig. 1)

The present disclosure relates to the detection of cross-site scripting vulnerabilities in a web application. The objective of the disclosure is to find a computer-implemented method for detecting cross-site scripting vulnerabilities in a web application. The detection of XSS vulnerabilities shall be performed automatically and the number of false positives shall be reduced compared to the prior art.

Zusammenfassung wird geladen …

Zusammenfassung wird geladen …

Zusammenfassung wird geladen …

A technology is disclosed for automated risk analysis for the deployment of software component updates in complex microservice architectures. Dependencies and versions of deployment situations in test setup environments and in a target environment are analyzed and compared to identify a version delta between tested and production deployments. Further, test results for test deployments are used to identify and remove unsuccessful test setups. Successful test setups are ranked according to extend of their version delta against the target environment and one of the successful test setups is selected according to a deployment strategy. After a test setup is selected, a deployment plan considering service versions and dependencies is generated that guarantees a tested and functional state of the target environment after each deployment step.

Zusammenfassung wird geladen …

A computer-implemented method is presented for identifying vulnerable software from a computer system. The method includes: identifying name of a given software component in a vulnerability database by analyzing text of an entry in the vulnerability database using a large language model, where entries in the vulnerability database have known vulnerabilities; identifying a patch for the given software component in a source code repository by analyzing text of the entry in the vulnerability database using the large language model; identifying the patch for the given software component in the source code repository by analyzing text in the source code repository using the large language model; and reporting the given software component as being vulnerable in response to identifying the patch for the given software component in the source code repository.

Zusammenfassung wird geladen …

Zusammenfassung wird geladen …

Zusammenfassung wird geladen …

Zusammenfassung wird geladen …

A technology is presented for the efficient matching of received data elements with medium to large sets of fluctuating matching rules. To cope with high volumes of data elements, a distributed architecture is used, which leverages optimized multi-rule evaluation approaches, like Intel's Hyperscan, to achieve sublinear computational complexity for the rule matching process. Processing of rule updates, and generation of corresponding optimized evaluation instructions is performed on a central management node, which distributes generated optimized matching code to multiple worker nodes for the actual matching process. Further, optimized multi-rule evaluation is combined with application of individual match rules, to support the fast application of matching rule changes if required. Compilation strategies are applied to eventually transform individually applied rules into a corresponding optimized multi-rule evaluation form. (Fig. 5)

Zusammenfassung wird geladen …

A technology for the adaptive compression of time series of complex monitoring data records is disclosed. Variants of complex monitoring data may describe multiple observations of the same type and from the same source from different timestamps, or they may describe multiple, related observations from the same source from the same timestamp. Meta-data for individual complex monitoring data records is analyzed to identify portions of the monitoring data record that can be omitted without loss of data to improve the compression rate. Different base compression methods may be applied for individual entities of monitoring data, depending on the data type used to represent the monitoring data entity, like XOR compression for floating point types. Compressed data is stored to a storage stream, where meta-data that is required to determine the omitted portions of complex data records is stored before corresponding observation payload data.

Zusammenfassung wird geladen …

The disclosure concerns the time-based correlation of time series for the root cause analysis of application monitoring data, observability data, and data observability data in the field of application monitoring and observability. The object of the disclosure is to find at least one candidate time series that has a high chance / probability for causing an event in a reference time series. The method shall be time-based and not frequency based. The method includes: constructing a simplified reference time series retaining changes in the reference time series and setting other points to zero; constructing a simplified candidate time series retaining changes in the candidate time series and setting other points to zero; calculating a similarity metric between the simplified candidate time series and the simplified reference time series; and reporting an occurrence of a computing event in response to the similarity metric exceeding a threshold value. (Fig. 20)

Zusammenfassung wird geladen …

Zusammenfassung wird geladen …

Tightly coupling cyber deception with software applications is promising in the lab but poses significant technical challenges in production systems. Because security measures are usually the responsibility of a system operator, access is typically limited to built software artifacts rather than their source code. This limitation makes it particularly challenging to deploy cyber deception techniques at application runtime and without full control over the software development lifecycle.

Zusammenfassung wird geladen …

Zusammenfassung wird geladen …

Zusammenfassung wird geladen …

Zusammenfassung wird geladen …

Zusammenfassung wird geladen …

Zusammenfassung wird geladen …

Zusammenfassung wird geladen …

Zusammenfassung wird geladen …

Zusammenfassung wird geladen …

Zusammenfassung wird geladen …

A computer-implemented method is presented for storing log data generated in a distributed computing environment. The method includes: receiving a log line, where the log line is associated with a given computing source producing the log line; applying a first tokenization rule to create a plurality of base tokens; applying a second tokenization rule to create a plurality of combination tokens; applying a third tokenization rule to create a plurality of n-gram tokens; combining the plurality of tokens into a set of tokens; for each token in the set of tokens, storing a given token by applying a hash function to the given token to generate a hash value, where the given token is associated with a given computing source at which the log line was produced; updating a listing of computing entities with the given computing source, where entries in the listing of computing entities can identify more than one computing sources and each entry in the listing of computing entities specifies a unique set of computing sources; and storing the hash value, along with an address, in a token map table of a probabilistic data structure, where the address maps the hash value to an entry in the listing of computing entities. (Fig. 1)

A technology is disclosed to perform real-time and online identification and prioritization of vulnerabilities of components of software applications. Agents are deployed to components of monitored applications that monitor and report application topology, communication, code execution and code loading activity. Reported code loading and execution activity data is used to detect the loading and execution of vulnerable code, topology and communication data is used to create a topology model of the application containing communication paths, trust boundaries and location of sensitive data. The analysis of code loading and execution data reveals the extend to which vulnerable code is used by monitored application components. The topology data combined with code execution data reveals the extent to which components executing vulnerable code are exposed to untrusted entities and/or accessing sensitive data. Execution data of vulnerable code, exposure and access data of components executing the vulnerable code are used to calculate priority scores for identified vulnerabilities.

Technologies are disclosed for the automated, rule-based generation of models from arbitrary, semi-structured observation data. Context data of received observation data, like data describing the location of on which a phenomenon was observed, is used to identify related observations, to generate entities in a model describing the observed data and to assign observations to model data. Mapping rules may be used for the on-demand generation of models, and different sets of mapping rules may be used to generate different models out of the same observation data for different purposes. Further, observation time data may be used to observer the temporal evolution of the generated model. Possible use cases of the so generated models include the interpretation of observation data that describes unexpected operation conditions in view of the generated model, or to determine how a monitored system reacts on changing conditions, like increased load. (Fig. 2)

A technology for the optimized capturing of resource file content for resources referred in recorded user interaction sequences is disclosed. Individual resource files are typically referred in multiple recorded resources, therefore it is desired to capture those resources only once and reuse them for all recorded session capturing them. As user interaction sequences are executed and captured in independently operating web-browsers, a direct coordination between recording web-browsers to avoid multiple captures of the same resource is not possible. Data about the global resource capturing and demand situation is generated on a monitoring server that receives all session recording data and transferred to session recording browsers in form of lists identifying resources that are referred in sessions but are still unresolved and should therefore be captured, and for resources that should not captured, because they are already available and capturing them again should be avoided.

Zusammenfassung wird geladen …

Zusammenfassung wird geladen …

Zusammenfassung wird geladen …

The invention relates to a computer-implemented method for monitoring memory allocation during execution of an application in a distributed computing environment, comprising: intercepting, by an agent, bytecode for the application while the application is being loaded, where the agent resides on the computing device; and extracting, by the agent, a control flow graph from the bytecode before the step of identifying execution paths in the application, where each node in the control flow graph belongs to only one identified execution path and the application resides on a computing device; identifying execution paths in the application using the control flow graph; for each identified execution path in the application, determining memory allocations which occur during execution of a given execution path; for each identified execution path in the application, determining only one location for an allocation counter in the given execution path, where the allocation counter in the given execution path increments in response to execution of the given execution path; for each identified execution path in the application, instrumenting the given execution path with an allocation counter at the location, where the allocation counter is placed at the location in the given execution path and the allocation counter reports a count value for the allocation counter; receiving, by the agent, the count value reported by the allocation counter; formulating, by the agent, memory allocation data for the given execution path, where the memory allocation data includes the count value reported by the allocation counter; sending, by the agent, the memory allocation data to a monitoring server located remotely from the first computing device; monitoring, by a sensor instrumented in the application, execution of a transaction which performed the memory allocations; sending, by the sensor, transaction data to the monitoring server, where the transaction data includes an identifier for the transaction; and correlating, by the monitoring server, the transaction data with the memory allocation data, wherein the memory allocation data includes at least one of the identifier for the transaction or an identifier for a thread which executed the application. Further, a computer-implemented system for monitoring memory allocation during execution of an application in a distributed computing environment is provided.

Zusammenfassung wird geladen …