| 摘要 |
In one embodiment, a method includes receiving client-server connection data for clients and servers, the data including IP addresses corresponding to the servers, for each one of a plurality of IP address pairs performing a statistical test to determine whether the IP addresses in the one IP address pair are related by common clients based on the number of the clients connecting to each of the IP addresses in the one IP address pair, generating a graph including a plurality of vertices and edges, each of the vertices corresponding to a different IP address, each edge corresponding to a different IP address pair determined to be related by common clients in the statistical test, and clustering the vertices yielding clusters, a subset of the IP addresses in one of the clusters providing an indication of the IP addresses of the servers serving a same application. |
| 主权项 |
1. A method comprising:
receiving, by a communication interface, client-server connection data for a plurality of clients and a plurality of servers, the client-server connection data including a plurality of server Internet Protocol (IP) addresses corresponding to the plurality of servers; for each one IP address pair of a plurality of IP address pairs selected from the plurality of server IP addresses, performing, by a processor, a statistical test to determine whether the server IP addresses in the one IP address pair are related by common clients based on the number of the clients connecting to each of the server IP addresses in the one IP address pair; generating, by the processor, a graph including a plurality of vertices and a plurality of edges between the vertices, each of the vertices corresponding to a different one of the server IP addresses, each one edge of the edges corresponding to a different one of the IP address pairs determined to be related by the common clients in the statistical test, the one edge connecting the server IP addresses in the one IP address pair determined to be related by the common clients in the statistical test; and clustering, by the processor, the vertices in the graph yielding a plurality of clusters, each of the clusters including the vertices representing a subset of the server IP addresses, the subset of the server IP addresses in one of the clusters providing an indication of the server IP addresses of the servers serving a same application. |
