Traffic correlation is the practice of matching network flows with endpoint, DNS, proxy, or log data to infer what a connection is really doing. A single IP address or encrypted session often reveals little on its own, but when defenders line it up with process creation, DNS lookups, or application behavior, the full picture becomes clearer.
This matters in cyber security because attackers often hide behind proxies, tunnels, and multi-hop relay chains. Correlation can expose malware callbacks, data exfiltration, or command-and-control traffic even when the payload is encrypted. In defense, analysts use it to tie a flow to the process that started it, identify unusual name resolution, and distinguish legitimate services from covert infrastructure. The technique is especially useful when blocklists fail and behavior is the best clue.