Patent ID: 7385924

Claim:
A method enabling a flow-based data collection scheme, comprising receiving a flow, the flow comprising at least one packet; monitoring the flow in relation to at least one flow attribute; associating a traffic type to the flow; upon termination of the flow, composing a flow data record comprising a traffic type identifier corresponding to the traffic type associated with the flow and the at least one monitored flow attribute; and storing the flow data record in a database; wherein associating the traffic type to the flow comprises: parsing at least one packet associated with the flow into a flow specification, wherein said flow specification contains at least one instance of any one of the following: a protocol family designation, a direction of packet flow designation, a protocol type designation, a pair of hosts, a pair of ports, a pointer to a multipurpose internet mail extensions (MIME) type, a pointer to an application-specific attribute; matching the flow specification of the parsing step to a plurality of hierarchically-recognized traffic types represented by a plurality of nodes, each node having a traffic specification defining at least one matching attribute; thereupon, having found a matching node in the matching step, associating the flow specification with a traffic type of said plurality of hierarchically-recognized traffic types.