Patent ID: 6985920

Claim:
A method of grouping network events, comprising: receiving a stream of network events, each network event including a set of event parameters in association with a network session that corresponds to a message being transmitted through a network; for a network event in the stream, making an initial session determination by determining whether the event belongs to a same network session as any previously received event; for the network event, identifying information of network address translations performed by one or more devices along a network transmission path associated with the network event; categorizing the network event in accordance with at least one of the session determination and the network address translation information; and at a predefined time, processing a categorized network event to identify another categorized network event, if any, belonging to a same network session as the categorized network event; grouping the categorized network event and the identified other categorized network event, if any, into a set; and assigning a unique identifier to the set of events that includes the categorized network event.