Patent Document ID: 8626691
Application ID: 12642783

Base Claim:
1. A method of detecting a server operating in a network, comprising: collecting Internet Protocol traffic information; merging the Internet Protocol traffic information having a common source address and a common destination address; merging the Internet Protocol traffic information having a source address and an opposing destination address to generate bidirectional flows; separating valid bidirectional flows from invalid bidirectional flows; retrieving a set of heuristic rules from memory for determining the server; determining an output of each heuristic rule in the set of heuristic rules based on the valid bidirectional flows; combining all outputs produced by the set of heuristic rules; and generating a probability that the source address corresponds to the server based on combined outputs produced by the set of heuristic rules.

---

Claim 3:
3. The method according to claim 1 , further comprising determining the destination address corresponds to a client.