An intra-session network correlation system receives a stream of network events and then group them into different network session according to each event's event parameters and the corresponding network address translation (NAT) information. An event in the stream is first matched against any existing session, and then categorized using the information about a NAT device that translates a message the event is related to. Finally, at a predefined time, a categorized event is processed to identify other categorized events in accordance with a NAT message or an expiry timer associated with the categorized event, and the categorized event and identified other categorized events are grouped into the same network session.