Patent ID: 8819227

Claim:
A method for profiling network traffic of a network, comprising: obtaining, by a processor of a computer system and from the network traffic, a plurality of domain name service (DNS) flows comprising a plurality of client Internet protocol (IP) addresses, a plurality of fully qualified domain names (FQDNs), and a plurality of server IP addresses, wherein the plurality of DNS flows comprise a DNS query that is initiated from a client IP address of the plurality of client IP addresses to request service based on a FQDN of the plurality of FQDNs that is contained in the DNS query, and wherein the plurality of server IP addresses comprise a server IP address that is resolved by a DNS server in the network based on the FQDN as requested from the client IP address and returned in a DNS response contained in the plurality of DNS flows; analyzing, by the processor, the plurality of DNS flows to generate a mapping between the plurality of client IP addresses, the plurality of server IP addresses, and the plurality of FQDNs; storing the mapping in a data structure separate from the DNS server, wherein each of the plurality of client IP addresses and each of the plurality of server IP addresses form a client/server IP address pair that is used as input to the data structure for looking up one of the plurality of FQDNs as output of the data structure; and analyzing the network traffic based on the data structure to generate a result of profiling the network traffic, wherein analyzing the network traffic based on the data structure comprises: obtaining, from the network traffic, a plurality of flows comprising a first portion of the plurality of client IP addresses, a second portion of the plurality of server IP addresses, and a plurality of server ports; tagging the plurality of flows using corresponding FQDNs that are looked up using the data structure based on the first portion of the plurality of client IP addresses and the second portion of the plurality of server IP addresses contained in the plurality of flows; storing the plurality of flows in association with the corresponding FQDNs in a repository as a plurality of tagged flows; and tallying a plurality of portions of the plurality of tagged flows to generate a plurality of tallies, wherein at least one portion of the plurality of portions is defined based on a common FQDN among the plurality of FQDNs and a common server port among the plurality of server ports that are shared by all flows in the at least one portion, and wherein the result comprises the plurality of tallies.