Patent ID: 7853685

Claim:
A computer-implemented method of identifying critical entities in a computer network, the method comprising: collecting network flow records for a predetermined period from a plurality of source devices; applying, using a visualizer, a plurality of rules to a plurality of application-server pairs based upon the collected network flow records; identifying, among the application-server pairs, one or more candidate application-server pairs that satisfy at least one of the plurality of rules during the predetermined period for each of the sources; determining, using the visualizer, a global application-server list including the candidate application-server pairs identified across all of the sources; adjusting, using the visualizer, importance levels assigned to the application-server pairs based upon said application-server pairs being included in the global application-server list; repeating the steps of collecting network flow records, applying a plurality of rules, and identifying the candidate application-server pairs during a subsequent predetermined period; determining another global application-server list based upon the candidate application-server pairs identified across all of the sources during the subsequent predetermined period; and adjusting the importance levels assigned to the application-server pairs to a lower level if the application-server pairs are not included in said another global application-server list but are included in said global application-server list.