Patent ID: 7580369

Claim:
A system for dynamically identifying internal hosts in a heterogeneous computing environment with multiple subnetworks, comprising: computer-executable program code stored in a computer-readable storage medium and executable by a processor, the computer-executable program code comprising a host classification module comprising computer-executable instructions operative, when executed, to cause the processor to classify an unknown originating host located at the source address of an outbound packet as an inside host with high confidence, classify an unknown receiving host located at the destination address of an inbound packet as an inside host, and reclassify the inside host as an inside host with high confidence upon receiving a further outbound packet having a source address corresponding to the address of the inside host; and an analysis module comprising computer-executable instructions operative, when executed, to cause the processor to analyze a plurality of packets, each such packet comprising a source address of an originating host and a destination address of a receiving host; determine whether the originating host or the receiving host in a packet has been definitively classified as inside host with high confidence; and conditionally forward the packet to the host classification module if the originating or receiving host in the packet have not been definitively classified as an inside host with high confidence.