Fingerprint Technology

A Fingerprint is the computed difference between two or more snapshots. It is possible to make Fingerprints from snapshots that show the state of one machine at different points in time, as well as snapshots of multiple machines. QtestBASE is fully compatible with physical as well as virtual machines.

As oposed to often done "Static Analysis" of an installation package (like an MSI file), by definition, the Fingerprint is based on physical data. That means that it contains the actual changes made to an actual machine (be it physical or virtual). This allows for a much closer look at what changes in a system are made.

It does not matter who or what performs the changes, be it an MSI package, a legacy EXE installer, some self made installation tool or even just a manual copy procedure, the Fingerprint Technology will find the changes.

Additionally, the ability to compare two or more different system snapshots (which are essentially system states), no matter where they come from, makes the Fingerprint Technology extremly flexible:

To detect the changes made by an application installation, one would create a snapshot before and after the installation process. The computed difference is the changes made by the application installation. Extending this process using more snapshots enables further analysis. For example one could afterwards uninstall the application and create another snapshot. The resulting differences contain the changes made by the uninstallation. More snapshots can be added to, for example, check the application start. This procedure is used to create Application Fingerprints for RA or CAP.

Another use case is the creation of a Fingerprint from snapshots of multiple machines. This Fingerprint would show the differences between these machines. Of course, comparing two totaly different systems is not very sensible. Think however of very similar machines like one would find in a server farm. Ideally all servers should be identical, except in very specific configuration entries. By creating a Fingerprint from these machines one can find the differences between those machines and thus, if the machines actually are as similar as they should be.


High Compression Technology

The Dynamic Testing approach employed by QtestBASE enables the very detailed collection of changes made to a system. This ability is one of the great advantages of QtestBASE. However, dealing with millions of data points requires a means of reducing the data to what is actually important. This is where the High Compression Technology (HCT) comes into play.

The HCT uses hundreds of rules to filter out all unnecessary data. This happens in a non-destructive manner, which means the data is not deleted, but can still be acessed if necessary.

All our pre-build rule configurations also include a HCT configuration targeted at typical system configurations of the latest Windows client and server operating systems.


Rule Engine

The Rule Engine is at the heart of the analysis of Fingerprints in QtestBASE. It consists of a multitude of comprehensive filters paired with an automatic rulebased evaluation system. Starting from simple data queries to conjunction of data sections of one Fingerprint to complex interconnection of multiple Fingerprints to each other, the Rule Engine enables automatic analysis of the extensive amounts of data accessible with our Fingerprint Technology.

The rule system has two main layers: aggregators are algorithms that perform complex data processing tasks. Each aggregator has a multitude of configuration options defining what data to take into account and which functions of the aggregator to use. This configuration is what makes up a rule.

Before creation of a Fingerprint, each of the over 20 different scan modules of our agent can separatly be enabled or disabled. By specifying includes and excludes the resulting data can be adjusted ito exactly fit the needs. This configuration is what we call a "scenario".

After creation of the Fingerprint, it is imported into the database for further processing. There the High Compression Technology (HCT) reduces the data in preparation of the automatic evaluation done by the Rule Engine.

Once the HCT is finished processing the Fingerprint data, the rule system performs analysis based on the rules configured beforehand. As opposed to earlier steps, which are mostly focused on data retrieval and reduction, the rules are singular assessment criteria, each governing a single specific occurence. They are not only filters but algorithms performing complex data analysis. The final result is presented in form of the colors of a traffic light: red, green or amber.