Malware domain detection using passive DNS
US-10237283-B2 · Mar 19, 2019 · US
US11726858B2 · US · B2
| Field | Value |
|---|---|
| Publication number | US-11726858-B2 |
| Application number | US-202217580113-A |
| Country | US |
| Kind code | B2 |
| Filing date | Jan 20, 2022 |
| Priority date | Jan 20, 2022 |
| Publication date | Aug 15, 2023 |
| Grant date | Aug 15, 2023 |
A practical reading order for non-experts. Skip the full description unless you need deep technical detail.
What the patent document calls the invention.
A short plain-language summary of the technical disclosure.
Who owns or filed the patent and who is credited as inventor.
Filing, priority, publication, and grant dates set the timeline.
The legal scope of protection — read this for what is actually claimed.
Technology tags used to group this patent with similar filings.
Prior art links and similar publications in this corpus.
Official abstract text for this publication.
A computer system configured to identify errors in a session launch initiated by a client application is provided. The computer system includes a memory and at least one processor coupled to the memory. The at least one processor is configured to receive one or more events from one or more applications or devices involved in the session launch, wherein an event of the one or more events comprises information from an application or device call (e.g., an application programming interface (API) call) communicated during the session launch, the information comprising destination information; build a primary Directed Acyclic Graph (DAG) based on the information from the API call; determine an error identifier based on the primary DAG; retrieve a troubleshooting recommendation from a library based on the error identifier; and send the troubleshooting recommendation to the client application.
Opening claim text (preview).
The invention claimed is: 1. A server computer system configured to identify errors in a session launch involving one or more components of a datacenter, wherein the session launch is initiated by a client application of a client endpoint device, the server computer system comprising: a memory; and at least one processor coupled to the memory and configured to execute an analytics service to: receive one or more events from one or more applications or devices involved in the session launch, wherein an event of the one or more events comprises information from one or more of an application or device call communicated during the session launch, the information specifying one or more of a destination application or device; build a primary Directed Acyclic Graph (DAG) based on the information from the one or more of the application or device call; determine an error identifier based on the primary DAG; retrieve a troubleshooting recommendation from a library based on the error identifier; and send the troubleshooting recommendation to one or more of the client application or an administrator application. 2. The server computer system of claim 1 , wherein: the client application executes under a first tenant context of a plurality of tenant contexts; and to receive the one or more events comprises to send an authentication token to the client application, to receive a request comprising the one or more events and the authentication token from the client application, and to establish authenticity of the request based on the authentication token. 3. The server computer system of claim 2 , wherein the authentication token: is valid for a limited time interval; and specifies the first tenant context. 4. The server computer system of claim 1 , wherein: the event further comprises a timestamp of the one or more of the application or device call, an event identifier, and a result code; and to build the primary DAG is further based on the timestamp of the one or more of the application or device call. 5. The server computer system of claim 1 , wherein the primary DAG comprises a node representing the event. 6. The server computer system of claim 5 , wherein to build the primary DAG comprises to assign an edge from the node directed toward a second node based on the one or more of the destination application or device, wherein the one or more of the destination application or device is associated with the second node. 7. The server computer system of claim 1 , wherein to determine the error identifier further comprises to identify an earliest terminating error based on a traversal of the primary DAG. 8. The server computer system of claim 7 , wherein to identify the earliest terminating error comprises to identify an earliest node of the primary DAG associated with an error. 9. The server computer system of claim 1 , wherein: the session launch is triggered by a first operation of the client application; the at least one processor is further configured to build a secondary DAG for a second operation of the client application; and the second operation is asynchronous to the first operation. 10. The server computer system of claim 1 , wherein to determine the error identifier comprises: to consume, via an event processing routine, one or more transactions associated with a tenant context; and to determine that an application configuration, a device configuration, or an operation has impacted the session launch. 11. The server computer system of claim 10 , wherein to consume the one or more transactions further comprises to correlate events corresponding to a respective transaction based on one or more of: a respective transaction identifier; a respective session key; or a respective resource identifier. 12. A method of identifying errors in a session launch involving one or more components of a datacenter, wherein the session launch is initiated by a client application of a client endpoint device, the method executed by an analytics service of a server and comprising: receiving one or more events from one or more applications or devices involved in the session launch, wherein an event of the one or more events comprises information from one or more of an application or device call communicated during the session launch, the information specifying one or more of a destination application or device; building a primary Directed Acyclic Graph (DAG) based on the information from the one or more of the application or device call; determining an error identifier based on the primary DAG; retrieving a troubleshooting recommendation from a library based on the error identifier; and sending the troubleshooting recommendation to one or more of the client application or an administrator application. 13. The method of claim 12 , wherein: the client application executes under a first tenant context of a plurality of tenant contexts; and receiving the one or more events comprises: sending an authentication token to the client application; receiving a request comprising the one or more events and the authentication token from the client application; and establishing authenticity of the request based on the authentication token. 14. The method of claim 13 , wherein the authentication token: is valid for a limited time interval; and specifies the first tenant context. 15. The method of claim 12 , wherein: building the primary DAG comprises assigning an edge from a node representing the event and directed toward a second node; assigning the edge is based on the one or more of the destination application or device; and the one or more of the destination application or device is associated with the second node. 16. The method of claim 12 , wherein determining the error identifier further comprises identifying an earliest terminating error based on traversing the primary DAG. 17. The method of claim 12 : wherein the session launch is triggered by a first operation of the client application; further comprising building a secondary DAG for a second operation of the client application; and wherein the second operation is asynchronous to the first operation. 18. A non-transitory computer readable medium storing executable sequences of instructions to identify errors in a session launch involving one or more components of a datacenter, wherein the session launch is initiated by a client application of a client endpoint device, the sequences of instructions comprising instructions to execute an analytics service to: receive one or more events from one or more applications or devices involved in the session launch, wherein an event of the one or more events comprises information from one or more of an application or device call communicated during the session launch, the information specifying one or more of a destination application or device; build a primary Directed Acyclic Graph (DAG) based on the information from the one or more of the application or device call; determine an error identifier based on the primary DAG; retrieve a troubleshooting recommendation from a library based on the error identifier; and send the troubleshooting recommendation to one or more of the client application or an administrator application. 19. The non-transitory computer readable medium of claim 18 , wherein: the client application executes under a first tenant context of a plurality of tenant contexts; and to receive the one or more events comprises to send an authentication token to the client application, wher
Root cause analysis, i.e. error or fault diagnosis (in a hardware test environment G06F11/22; in a software test environment G06F11/36) · CPC title
Error or fault detection not based on redundancy (power supply failures G06F1/30; network fault management H04L41/06) · CPC title
Remedial or corrective actions (recovery from an exception in an instruction pipeline G06F9/3861; by retry G06F11/1402; for recovering from a failure of a protocol instance or entity H04L69/40) · CPC title
Management of faults, events, alarms or notifications · CPC title
using root cause analysis; using analysis of correlation between notifications, alarms or events based on decision criteria, e.g. hierarchy, tree or time analysis · CPC title
Related publications grouped by family.
Answers are generated from the same data shown on this page.