1. A method of detecting a server operating in a network, comprising: collecting Internet Protocol traffic information; merging the Internet Protocol traffic information having a common source address and a common destination address; merging the Internet Protocol traffic information having a source address and an opposing destination address to generate bidirectional flows; separating valid bidirectional flows from invalid bidirectional flows; retrieving a set of heuristic rules from memory for determining the server; determining an output of each heuristic rule in the set of heuristic rules based on the valid bidirectional flows; combining all outputs produced by the set of heuristic rules; and generating a probability that the source address corresponds to the server based on combined outputs produced by the set of heuristic rules.