US 12,111,718 B2
Reconstructing execution call flows to detect anomalies
Satyendra Tiwari, San Jose, CA (US); Nikolaos Georgakopoulos, Patras (GR); Utkarsh Agarwal, Bengaluru (IN); Pavan Belani, Bengaluru (IN); Srinivas Reddy Kasu, Banglore (IN); and Rahul Kumar, Bengaluru (IN)
Filed by Citrix Systems, Inc., Fort Lauderdale, FL (US)
Filed on Jul. 12, 2021, as Appl. No. 17/373,107.
Application 17/373,107 is a continuation of application No. PCT/GR2021/000034, filed on May 26, 2021.
Prior Publication US 2022/0382617 A1, Dec. 1, 2022
Int. Cl. G06F 11/00 (2006.01); G06F 11/07 (2006.01); G06F 16/28 (2019.01)
CPC G06F 11/0751 (2013.01) [G06F 11/0721 (2013.01); G06F 16/285 (2019.01)] 17 Claims
OG exemplary drawing
 
1. A method comprising:
establishing, by one or more processors using information extracted from a log file, a plurality of call flows, each of the plurality of call flows identifying information from the log file of a call flowing through a plurality of modules in accessing an application, the one or more processors extracting the information from the log file for each call flow of the plurality of call flows based at least on a timestamp, each call flow having a common unique transaction identifier and information from the log file for each call flow identified by the common unique transaction identifier;
identifying, by the one or more processors, a count of a number of occurrences of one or more natural language keywords from the log file in information of each call flow of the plurality of call flows;
generate, by the one or more processors, a vector of numbers for each call flow based at least on the count for the one or more keywords for that call flow; and
classifying, by the one or more processors using the vector of numbers for each call flow, each call flow into one or more clusters, each of the one or more clusters identifying which modules are performing better than other modules of the plurality of modules; and
updating, by the one or more processors, a configuration of one or more of the other modules in accessing the application based at least on the one or more clusters.