A system includes multiple logging units, an aggregating unit, and an evaluation unit. The logging unit logs traffic attributes associated with network traffic received at multiple network nodes and generates traffic signatures using the received attributes. The aggregating unit aggregates the traffic signatures generated at the multiple logging units. The evaluating unit determines relationships among the network traffic or between the plurality of network nodes using the aggregated traffic signatures.