15. A memory storing executable instructions that when executed cause a processor to perform operations, the operations comprising: collecting Internet Protocol traffic information; merging the Internet Protocol traffic information having a common source address and a common destination address to generate unidirectional flows; merging the Internet Protocol traffic information having a source address and an opposing destination address to generate bidirectional flows; separating valid bidirectional flows from invalid bidirectional flows; retrieving a set of heuristic rules from memory, the set of heuristic rules differentiating the server from a client based on a difference in timestamps of the unidirectional flows; determining an output of each heuristic rule in the set of heuristic rules based on the valid bidirectional flows; combining all outputs produced by the set of heuristic rules; and generating a probability that the source address corresponds to the server based on combined outputs produced by the set of heuristic rules.
15. A memory storing executable instructions that when executed cause a processor to perform operations, the operations comprising: collecting Internet Protocol traffic information; merging the Internet Protocol traffic information having a common source address and a common destination address to generate unidirectional flows; merging the Internet Protocol traffic information having a source address and an opposing destination address to generate bidirectional flows; separating valid bidirectional flows from invalid bidirectional flows; retrieving a set of heuristic rules from memory, the set of heuristic rules differentiating the server from a client based on a difference in timestamps of the unidirectional flows; determining an output of each heuristic rule in the set of heuristic rules based on the valid bidirectional flows; combining all outputs produced by the set of heuristic rules; and generating a probability that the source address corresponds to the server based on combined outputs produced by the set of heuristic rules. 19. The memory according to claim 15 , wherein the operations further comprise retrieving an interval of time for collecting the Internet Protocol traffic information.