Patent ID: 7881255

Claim:
A method performed by one or more server devices, comprising: receiving, via at least one server device of the one or more server devices, attributes associated with network traffic logged at a plurality of network nodes; generating, via at least one server device of the one or more server devices, traffic signatures using the received attributes; determining, via at least one server device of the one or more server devices, relationships between the plurality of network nodes or among the network traffic using the generated traffic signatures, where determining the relationships includes: clustering the generated traffic signatures to determine the relationships between the plurality of network nodes or among the network traffic, and determining clusters of the plurality of network nodes that are related using the clustered traffic signatures, where determining the clusters includes determining, based on the relationships, one or more of the plurality of network nodes that receive traffic from a common source; determining, via at least one server device of the one or more server devices, a common traffic value comprising a number of times the common source visited a document stored at one of the plurality of network nodes; and storing, via at least one server device of the one or more server devices, the common traffic value.