Method for deobfuscation of customer clickstream telemetry data

Patent metadata

Field	Value
Publication number	US-10621179-B2
Application number	US-201715653025-A
Country	US
Kind code	B2
Filing date	Jul 18, 2017
Priority date	Jul 18, 2017
Publication date	Apr 14, 2020
Grant date	Apr 14, 2020

Abstract

One or more embodiments provide techniques for analyzing telemetry data. A telemetry agent collects streams of raw telemetry data from the web client. The telemetry data includes obfuscated strings. For each obfuscated string, a mapping program references a database associating the obfuscated string to attributes of a properties file of the web client. The attributes include at least the deobfuscated string corresponding to the obfuscated string. An analytics agent translates the streams of raw telemetry data to streams of modified telemetry data. The streams of modified telemetry data include deobfuscated string from the attributes corresponding to the properties file. The analytics agent analyzes the streams of modified telemetry data.

First claim

We claim:

1. A method of analyzing telemetry data of a web client, comprising:
collecting streams of raw telemetry data from the web client, wherein the telemetry data comprises obfuscated strings, the obfuscated strings comprising at least one user-sensitive string;
for at least one of the obfuscated strings, referencing a database associating the obfuscated string to attributes of a properties file of the web client, wherein the attributes include at least a deobfuscated string corresponding to the obfuscated string;
translating the streams of raw telemetry data to streams of modified telemetry data, wherein the modified telemetry data comprises the deobfuscated string from the attributes corresponding to the properties file and obfuscation of the at least one user-sensitive string is maintained with the deobfuscated string in modified telemetry data; and
analyzing the streams of modified telemetry data.

2. The method of analyzing telemetry data of the web client of claim 1 , wherein collecting streams of raw telemetry data from the web client, wherein the telemetry data comprises obfuscated strings, comprises:
collecting another streams of raw telemetry data of a web client plugin for the web client.

3. The method of analyzing telemetry data of the web client of claim 2 , wherein for each obfuscated string, referencing a database associating the obfuscated string to attributes in a properties file of the web client, wherein the attributes includes at least the deobfuscated string corresponding to the obfuscated string, comprises:
for each obfuscated string associated with web client plugin, referencing another database associating the obfuscated string to attributes in a properties file of the web client plugin.

4. The method of analyzing telemetry data of the web client of claim 3 , wherein translating the streams of raw telemetry data to streams of modified telemetry data, wherein the modified telemetry data comprises the deobfuscated string from the attributes corresponding to the properties file, comprises:
translating the other streams of raw telemetry data associated with web client plugin to another streams of modified telemetry data, wherein the other streams of modified telemetry data comprises the deobfuscated string from the attributes corresponding to the properties file of the web client plugin.

5. The method of claim 1 , wherein attributes of a properties file further includes a locale of the obfuscated string.

6. The method of analyzing telemetry data of the web client of claim 1 , wherein the database includes a plurality of key/value entries, wherein a key refers to an obfuscated string and a value refers to attributes of a properties file.

7. The method of analyzing telemetry data of the web client of claim 1 , wherein the database is generated through a process, comprising:
scanning the properties files of the web client;
extracting a deobfuscated string associated with each properties file;
applying a hashing algorithm to the deobfuscated string to generate an obfuscated string;
associating each obfuscated string with at least its respective deobfuscated string from a properties file; and
storing the association in the database.

8. A non-transitory computer readable medium having instructions stored thereon that when executed by a processor cause the processor to perform a method of analyzing telemetry data of a web client, comprising:
collecting streams of raw telemetry data from the web client, wherein the telemetry data comprises obfuscated strings, the obfuscated strings comprising at least one user-sensitive string;
for at least one of the obfuscated strings, referencing a database associating the obfuscated string to attributes of a properties file of the web client, wherein the attributes include at least a deobfuscated string corresponding to the obfuscated string;
translating the streams of raw telemetry data to streams of modified telemetry data, wherein the modified telemetry data comprises the deobfuscated string from the attributes corresponding to the properties file and obfuscation of the at least one user-sensitive string is maintained with the deobfuscated string in modified telemetry data; and
analyzing the streams of modified telemetry data.

9. The non-transitory computer readable medium of claim 8 , wherein collecting streams of raw telemetry data from the web client, wherein the telemetry data comprises obfuscated strings, comprises:
collecting another streams of raw telemetry data of a web client plugin for the web client.

10. The non-transitory computer readable medium of claim 9 , wherein for each obfuscated string, referencing a database associating the obfuscated string to attributes in a properties file of the web client, wherein the attributes includes at least the deobfuscated string corresponding to the obfuscated string, comprises:
for each obfuscated string associated with web client plugin, referencing another database associating the obfuscated string to attributes of a properties file of the web client plugin.

11. The non-transitory computer readable medium of claim 10 , wherein translating the streams of raw telemetry data to streams of modified telemetry data, wherein the modified telemetry data comprises the deobfuscated string from the attributes corresponding to the properties files, comprises:
translating the other streams of raw telemetry data associated with web client plugin to another streams of modified telemetry data, wherein the other streams of modified telemetry data comprises the deobfuscated string from the attributes corresponding to the properties file of the web client plugin.

12. The non-transitory computer readable medium of claim 8 , wherein attributes of a properties file further includes a locale of the obfuscated string.

13. The non-transitory computer readable medium of claim 8 , wherein the database includes a plurality of key/value entries, wherein a key refers to an obfuscated string and a value refers to attributes of a properties file.

14. The non-transitory computer readable medium of claim 8 , wherein the database is generated through a process, comprising:
scanning the properties files of the web client;
extracting an un-obfuscated string associated with each properties file;
applying a hashing algorithm to the un-obfuscated string to generate an obfuscated string;
associating each obfuscated string with at least its respective deobfuscated string from properties file; and
storing the association in the database.

15. A computer system, comprising:
a processor; and
a memory storing program code, which, when executed on the processor, performs a method of analyzing telemetry data of a web client, comprising:
collecting streams of raw telemetry data from the web client, wherein the telemetry data comprises obfuscated strings, the obfuscated strings comprising at least one user-sensitive string;
for at least one of the obfuscated strings, referencing a database associating the obfuscated string to attributes of a properties file of the web client, wherein the attributes include at least a deobfuscated string corresponding to the obfuscated string;
translating the streams of raw telemetry data to streams of modified telemetry data, wherein the modified telemetry data comprises the deobfuscated string from the attributes corresponding to the properties file and obfuscation of the at least one user-sensitive string is maintained with the deobfuscated string in modified telemetry data; and
analyzing the streams of modified telemetry data.

16. The computer system of claim 15

Assignees

• Vmware Inc

Inventors

• Chomakov Vasil
• Hadjiiski Stanislav

Classifications

• G06F16/137

  Hash-based (content-based indexing of textual data G06F16/31) · CPC title

• G06Q30/0201 Primary

  Market modelling; Market analysis; Collecting market data · CPC title

• G06F16/90344

  by using string matching techniques · CPC title

• G06F16/258

  Data format conversion from or to a database · CPC title

• G06F16/24568 Primary

  Data stream processing; Continuous queries · CPC title