Information Technology Reference
In-Depth Information
URLs Chained Backward in Time.
The second important temporal con-
straint is due to the fact that a resource request cannot be made if the URL
pointer to that resource has not yet appeared in a response. For implicit re-
quests, this simply means the browser cannot request a URL that has not yet
been downloaded. For explicit requests, it means that users cannot click on URL
hyperlinks that have not yet appeared on screen. This constraint is summed up
as follows:
Constraint 2
: A link traversal is impossible if the request URL appears
before the response URL. A URL Match representing such a traversal is
invalid. Two connections cannot be chained if every URL Match between
them is invalid.
Since the packets of connections are interleaved on the wire, the content of
connections is interleaved in time. To determine the validity of a URL Match,
the timestamp of the request URL must be compared with the timestamp of the
response URL. In a timing diagram, HTTP events in a connection might look
like Figure 3.
Fig. 3.
Chaining Two Independent TCP Connections
Assuming a URL in the response of connection 1 matches the URL in the
request of connection 2 in the figure, we must decide whether it is temporally
possible that the request in connection 2 was initiated from 1. If not, the connec-
tions cannot be chained. To do this, URLs must be tagged with the time their
containing packet appeared in the trac stream.
2.3
Marking Likely Adjacencies
The preceding step identifies adjacencies that are definitively impossible, and
can therefore be removed from the connection graphs. The remaining adjacencies
cannot be removed this easily. Since they do not violate any of the constraints,
every remaining adjacency is a potential candidate for inclusion.
To accurately isolate user session fragments, the most likely of the remaining
adjacencies must be identified. A time oriented heuristic was developed to do
