Patent Document ID: 8429748
Application ID: 12626872
Patent Flag: 1

Claim One:
1. A method for network traffic analysis, said method comprising: deploying, across a network comprising a plurality of network nodes, at least one data collection agent, on at least two of said plurality of network nodes; monitoring, with each data collection agent at a respective network node, a plurality of network connections instantiated during a monitoring time period for said respective network node, wherein each data collection agent is inserted at the respective network node to interface with multiple locations of a network stack of an operating system of the respective network node to track each of the plurality of network connections associated with the respective network node; acquiring data from each data collection agent, said data resulting from said monitoring; creating an ontological description of the network using the acquired data, the ontological description of the network comprising the plurality of network nodes and current connections of the plurality of network nodes; updating said ontological description based on data subsequently acquired by each data collection agent at each network node; and analyzing network traffic using the updated ontological description.