A system for resolving network address to host names in network flows for a network device, the system comprising: the network device configured to produce a flow record; a flow record storage configured to receive said flow record from said network device and to store said flow record in a flow table (140, 300) comprising a flow record identifier, numerical source address, numerical destination address, time stamp value, and byte size value; a data analysis tool configured to use the stored flow records and statistical models to generate a statistical result that is subsequently stored in the flow record storage, wherein the statistical models are defined to solve network usage problems including network security abuse or fraud, and access said stored flow record and to identify a numerical network address contained in the stored flow record; and an address analysis tool (151, 630) comprising a mapping table, said mapping table comprising a plurality of mappings of numerical network addresses to possible text network addresses, wherein each of said mappings associates one of said possible numerical network address with one of said possible text network addresses, wherein the address analysis tool is configured to receive the numerical network address, to identify one of said mappings corresponding to said numerical network address, and to return a text network address associated in said one identified mapping, wherein the address analysis tool is further configured to create a modified flow table using the mapping table, wherein the address analysis tool is configured to create the modified flow table by identifying the numerical source address and the numerical destination address in the flow table and replacing the numerical source address and the numerical destination address from the flow table with the associated text network addresses identified from the mapping table, wherein the address analysis tool further comprises a data agent configured to receive the numerical network address and to access the network to dynamically create new mappings for said mapping table when said possible numerical network addresses do not include the numerical network address, wherein the flow record storage is configured to receive the text network address and to modify the stored flow record to include the text network address. the network device configured to produce a flow record; a flow record storage configured to receive said flow record from said network device and to store said flow record in a flow table (140, 300) comprising a flow record identifier, numerical source address, numerical destination address, time stamp value, and byte size value; a data analysis tool configured to use the stored flow records and statistical models to generate a statistical result that is subsequently stored in the flow record storage, wherein the statistical models are defined to solve network usage problems including network security abuse or fraud, and access said stored flow record and to identify a numerical network address contained in the stored flow record; and an address analysis tool (151, 630) comprising a mapping table, said mapping table comprising a plurality of mappings of numerical network addresses to possible text network addresses, wherein each of said mappings associates one of said possible numerical network address with one of said possible text network addresses, wherein the address analysis tool is configured to receive the numerical network address, to identify one of said mappings corresponding to said numerical network address, and to return a text network address associated in said one identified mapping, wherein the address analysis tool is further configured to create a modified flow table using the mapping table, wherein the address analysis tool is configured to create the modified flow table by identifying the numerical source address and the numerical destination address in the flow table and replacing the numerical source address and the numerical destination address from the flow table with the associated text network addresses identified from the mapping table, wherein the address analysis tool further comprises a data agent configured to receive the numerical network address and to access the network to dynamically create new mappings for said mapping table when said possible numerical network addresses do not include the numerical network address, wherein the flow record storage is configured to receive the text network address and to modify the stored flow record to include the text network address.