Defining and detecting network application business activities

Abstract

Network applications are monitored by defining and detecting activities associated with the applications. Such activities are referred to as 'business activities' in the sense that the activities are performed in the process of conducting business using applications. Each business activity of interest is associated with a unique 'business signature' which can be used to identify the activity from streams or collections of information. In one embodiment, each business signature of interest to a business is defined as a set of one or more parameter name-value pairs. Once defined, network traffic to and from an application is monitored to detect business signatures, to detect that a corresponding business activity was started. Detecting an activity is based on real-time matching of business signature character patterns within a stream of characters with a repository of character patterns that each represents a business signature defined for the application.