8. A system, comprising: a processor; and memory storing code that when executed causes the processor to perform operations, the operations comprising: collecting Internet Protocol traffic information; merging the Internet Protocol traffic information having a common source address and a common destination address to generate unidirectional flows; merging the Internet Protocol traffic information having a source address and an opposing destination address to generate bidirectional flows; separating valid bidirectional flows from invalid bidirectional flows; retrieving a set of heuristic rules from memory for determining the server, wherein one heuristic rule differentiates the server from a client based on a difference in timestamps of the unidirectional flows; determining an output of each heuristic rule in the set of heuristic rules based on the valid bidirectional flows; combining all outputs produced by the set of heuristic rules; and generating a probability that the source address corresponds to the server based on combined outputs produced by the set of heuristic rules.
8. A system, comprising: a processor; and memory storing code that when executed causes the processor to perform operations, the operations comprising: collecting Internet Protocol traffic information; merging the Internet Protocol traffic information having a common source address and a common destination address to generate unidirectional flows; merging the Internet Protocol traffic information having a source address and an opposing destination address to generate bidirectional flows; separating valid bidirectional flows from invalid bidirectional flows; retrieving a set of heuristic rules from memory for determining the server, wherein one heuristic rule differentiates the server from a client based on a difference in timestamps of the unidirectional flows; determining an output of each heuristic rule in the set of heuristic rules based on the valid bidirectional flows; combining all outputs produced by the set of heuristic rules; and generating a probability that the source address corresponds to the server based on combined outputs produced by the set of heuristic rules. 9. The system according to claim 8 , wherein the operations further comprise determining the source address fails to correspond to the server.