System and method for tracking and auditing data access in a network environment

摘要

A system and method that correlate business transaction in a system and traffic generated from this business transaction in a network back to a user identity that invoked this business transaction and generated subsequent network traffic. The method enables a user to set up rules for tracking the activities in a system and network traffic and these rules can then be user later for monitoring user activities. The user activities, network traffic, and the user identity are correlated and stored in a data-to-business mapping file. This data-to-business mapping file can be used for auditing events in the system.

主权项

1. A method for tracking user activities in a network system, comprising the steps of:
detecting, by a tracking server at an entry point in the network system, a request from a user; retrieving, by the tracking server from a storage unit, a rule based on the entry point and the request; tracking, by the tracking server, user access information associated with the request according to the rule; tracking, by the tracking server, a connection identification between servers associated with the request; recording the user access information and the connection identification in a data-to-business mapping file; and creating a timer for a session identification, wherein when the timer expires the data-to-business mapping file is closed and a new data-to-business mapping file created.