Patent ID: 7472183

Claim:
A method for capturing behavior for network components and for interactions between components comprising: accessing first data that defines one or more states and state transitions for a particular component or interaction between a particular two or more components, wherein the first data defines at least one composite state transition, each of said composite state transition comprising multiple state transitions; accessing second data that indicates, for the particular component or interaction between the particular two or more components, a set of one or more undesirable states or state transitions; wherein each of said one or more undesirable states or state transitions is a state or state transition of the one or more states and state transitions that is associated with undesirable behavior; accessing third data that indicates, for the particular component or interaction between the particular two or more components, a set of one or more illegal states or state transitions; wherein each of said one or more illegal states or state transitions is a state or state transition of the one or more states and state transitions that is associated with illegal behavior; wherein the set of one or more illegal states or state transitions is different from the set of one or more undesirable states or state transitions; and in response to the particular component or interaction between the particular two or more components entering a particular state or state transition, generating a notification corresponding to the particular state or state transition, wherein the particular state or state transition is one of the one or more states and state transitions; wherein the particular state or state transition belongs to either the set of one or more undesirable states or state transitions or the set of one or more illegal states or state transitions; the method further comprising: detecting that the particular component or interaction between the particular two or more components has entered the particular state or state transition; wherein said notification is generated in response to said step of detecting; wherein the step of detecting comprises: monitoring a condition associated with the particular component or interaction between the two or more particular components; querying a state table storing said first data to determine a state for the particular component or interaction between the two or more particular components; determining, based on the second data and third data, that the determined state belongs to either the set of one or more undesirable states or state transitions or the set of one or more illegal states or state transitions.