Patent ID: 11876775
Assignee: ARBOR NETWORKS, INC.
Field: Digital communication (Electrical engineering)
Classification: CPC H | IPC G  H

Claim 14:
15. A computer system for matching an internet service with an IP host address to attribute network traffic to the internet service by mapping one or more server names to an internet service by a network device, comprising:
a memory configured to store instructions;
a processor disposed in communication with said memory, wherein said processor upon execution of the instructions is configured to:
intercept network packets to monitor internet network traffic in a communication network;
detect a Domain Name System (DNS) Response to a DNS Query in the monitored internet network traffic;
inspect the DNS Response to determine an association of a service consumer's IP address with an internet service's server IP address in the detected DNS Response relating to a certain internet service;

maintain in an array of indexed entries, an association of the service consumer's IP address with an internet service's server IP address relating to a certain internet service for a certain length of time using a probabilistic data structure for the indexed entries;
extend the certain length of time upon continuing association of the service consumer's IP address with the internet service's server IP address in the monitored internet traffic relating to the certain internet service; and
expire the association of the service consumer's IP address with an internet service's server IP address relating to a certain internet service upon expiration of the certain length of time.