Patent ID: 9577898
Date: 2017-02-21
CPC Classifications: H04L

Claim:
1. A method for profiling network traffic of a network, comprising: capturing, from the network traffic using a packet capturing device, a plurality of packets; identifying a first portion of the plurality of packets as a first flow and a second portion of the plurality of packets as a second flow, wherein the first flow and the second flow are identified based at least on a common source IP address shared by each packet of the first flow and the second flow, wherein said each packet is assigned a source timestamp by a device generating said each packet and further assigned a capture timestamp by the packet capturing device; extracting, by a processor of a computer system and from the first flow, a first monotonic timestamp-pair (MTSP) sequence, wherein the first MTSP sequence comprises a first plurality of source-stamp-and-capture-timestamp-pairs based on the source stamp and the capture timestamp assigned to said each packet in the first portion of the plurality of packets; extracting, by the processor and from the second flow, a second MTSP sequence, wherein the second MTSP sequence comprises a second plurality of source-stamp-and-capture-timestamp-pairs based on the monotonically increasing source stamp and the capture timestamp assigned to said each packet in the second portion of the plurality of packets; comparing, by the processor and based on a pre-determined criterion, the first MTSP sequence and the second MTSP sequence to generate a result, wherein comparing the first MTSP sequence and the second MTSP sequence includes: determining, based on the result, whether the first flow and the second flow are generated by a single host of the network, wherein determining whether the first flow and the second flow are generated by a single host of the network includes determining whether both the capture timestamp proximity condition and the source timestamp proximity condition is met or determining that the MTSP matches the predicted source timestamp range for the second flow; and based on determining that the first flow and the second flow are generated by a single host of the network, merging the first and second flow into a single flow.