Patent ID: 7797419

Claim:
A method of grouping network events, the method comprising the computer-implemented steps of: receiving a stream of network events, each network event including a set of event parameters in association with a network session that corresponds to a message being transmitted through a network, wherein the set of event parameters includes two or more of: a source address, a source port, a destination address, a destination port, and a network protocol, wherein a plurality of network events are associated with a security attack being detected; for a particular network event in the plurality of network events: making an initial session determination by determining whether a particular network event belongs to a same network session as any previously received network event; wherein said network session is a communication channel established between a source host and a destination host over the network, wherein the initial session determination includes comparing one or more of the set of event parameters of the particular network event with one or more of the set of event parameters of one or more previously received network events, and if there is a match, determining that the particular network event belongs to a same network session as those matching one or more previously received network events; identifying information of network address translations performed by one or more of the devices that translate one or more of the set of event parameters for the particular network event to one or more other event parameters on the communication channel, wherein each of said one or more devices is associated with at least one network address translation rule, each network address translation rule comprising a pre-mapping parameter domain and a post-mapping parameter domain for one or more event parameters; categorizing the particular network event based at least in part on at least one of the session determination and the information of network address translations performed; identifying another categorized network event associated with the one or more other event parameters; grouping the categorized particular network event and the identified other categorized network event into a set of network events associated with the security attack; wherein the information of network address translations performed is received after the categorized network event; wherein the method is performed by one or more computing devices.