Patent ID: 8510830

Claim:
An apparatus for collecting netflow data comprising: a processor adapted to execute one or more processes; and a memory configured to store a process executable by the processor, the process when executed operable to: receive, via the apparatus, a plurality of flow records from at least one network device, each flow record having at least a source Internet Protocol (IP) address and a destination IP address; extract, via the apparatus, data from the received flow records into a block data structure, wherein the block data structure includes a plurality of individual elements each storing extracted data including the source IP address and the destination IP address from a respective flow record, and an index of each of the plurality of individual elements; sort, via the apparatus, the individual elements in the block data structure by re-ordering the index of each of the plurality of individual elements; and process, via the apparatus, the block data structure as a data stream according to the stored individual elements to identify a pattern of network usage based on a number of flow records indicating at least a same IP address or destination IP address.