US 7,543,051 B2
Method of non-intrusive analysis of secure and non-secure web application traffic in real-time
Bernd Greifeneder, Linz (Austria); Bernhard Reichl, Linz (Austria); Helmut Spiegl, Linz (Austria); and Gunter Schwarzbauer, Linz (Austria)
Assigned to Borland Software Corporation, Austin, Tex. (US)
Filed on May 30, 2003, as Appl. No. 10/455,798.
Prior Publication US 2004/0243349 A1, Dec. 02, 2004
Int. Cl. G06F 15/16 (2006.01)
U.S. Cl. 709—224  [709/227] 10 Claims
OG exemplary drawing
 
1. A system for non-intrusive real-time analysis of secure communications between a first application running on a first computer and a second application running on a second computer, the first and second applications using a communication channel, the system comprising:
a non-intrusive and secure communications capture device, connected to the communications channel;
a network module, connected to the communications capture device and configured to process communications from a physical layer to a network layer substantially in real-time; and
a session reconstruction unit, connected to the network module and configured to process communications to an application layer in real-time, to group communications into transactions and to arrange transactions in a hierarchical data structure according to dependencies within the information contained in the transactions, the session reconstruction unit further comprising:
a stream creation unit, connected to the network module and configured to receive a plurality of communications and group them into a plurality of streams, and to add connection meta information to each stream, wherein each stream represents a single network connection;
a message decoder, connected to the stream creation unit and configured to create a plurality of transactions from the communications included in the plurality of streams;
a transaction storage, connected to the message decoder, configured to store the plurality of transactions; and
a session reconstruction module, connected to the transaction storage, and configured to receive a transaction of interest, and to retrieve a set of transactions from the transaction storage, the set of transactions being such that each transaction belonging to the set of transactions has a predefined relationship with the transaction of interest, and to group the set of transactions in the hierarchical data structure according to dependencies within the information contained in the transactions.