Patent ID: 7831703
Filing Date: 2010-11-09
Classification: G06F,H04L

Abstract:
1. An apparatus configured to monitor and audit activity in a network, the network utilizes an incremental screen protocol, the apparatus comprising: a) an analyzer being configured to analyze intercepted packets, wherein said packets are conveyed between entities in the network other than the apparatus, and being configured to generate analyzed data based on information associated with at least some of said packets, the analyzed data being indicative of sessions and being indicative of the incremental screen protocol used in each of said sessions; b) a mirror manager being incrementally updated to reflect a most recent change in an on-screen field location of data responsive to the intercepted packets; c) a data storage unit comprising a non-transitory computer-readable medium accessible thereto for storing the data indicative of sessions and being indicative of the incremental screen protocol; and d) an audit event analyzer being responsive to said mirror data, said audit event analyzer being configured to generate event data representative of inbound audit events and outbound audit events between the other entities in the network, said event data including characteristics relating to the on-screen field location of data being part of the inbound audit events and outbound audit events, said on-screen field location being representative of at least one operation performed in the network, said audit event analyzer being adapted to analyze said event data for extracting extracted data from event data representative of an inbound audit event together with the characteristics respective of said inbound audit event, and to generate event data representative of a united audit event by combining the extracted data with one or more fields in event data representative of an outbound audit event based on said characteristics.