MONITORING AN APPLICATION IN A PROCESS VIRTUAL MACHINE

摘要

An application that runs in a process virtual machine is monitored by injecting listening code into a target class of the application. The listening code collects and forwards data to a monitoring agent. The target class is configured for monitoring according to alternative embodiments. In response to the process virtual machine providing notification of an event, such a loading the target class, the listening code may be injected into the target class. In another embodiment, the process virtual machine is configured to load a first mirror class containing a mirror entry point to the application. A mirror target class is loaded in response to a request to load the target class. The mirror target class contains a mirror entry point to the target class and the listening code. In another embodiment, listening code may be added to the target class before running the application.

主权项

1. A computer-implemented method, comprising:
receiving an identification of a target class of an application that runs in a process virtual machine on a computer system by a monitoring agent; configuring the target class for monitoring by listening code; running the monitoring agent, the process virtual machine, and the application on the computer system; collecting data by the listening code; sending the collected data to the monitoring agent by the listening code; and sending the collected data to a collector by the monitoring agent, wherein the collector is operable to analyze the collected data to identify an unauthorized access to the application.