Patent ID: 11876775
Assignee: ARBOR NETWORKS, INC.
Field: Digital communication (Electrical engineering)
Classification: CPC H | IPC G  H

Claim 0:
1. A computer implemented method for matching an internet service with an IP host address to attribute network traffic to the internet service by mapping one or more server names to an internet service by a network device, comprising:
monitoring internet network traffic in a communication network by the network device;
detecting a Domain Name System (DNS) Response to a DNS Query in the monitored internet network traffic;
inspecting the DNS Response to determine an association of a service consumer's IP address with an internet service's server IP address in the detected DNS Response relating to a certain internet service;
maintaining in an array of indexed entries, an association of the service consumer's IP address with an internet service's server IP address relating to a certain internet service for a certain length of time using a probabilistic data structure for the indexed entries;
extending the certain length of time upon continuing association of the service consumer's IP address with the internet service's server IP address in the monitored internet traffic relating to the certain internet service; and
expire the association of the service consumer's IP address with an internet service's server IP address relating to a certain internet service upon expiration of the certain length of time.