According to one embodiment, a network architecture includes a plurality of application monitoring modules for monitoring network traffic data that store the data in meta-flow tuples with associated measures. The meta-flow tuples include a protocol dimension with a value corresponding to a leaf node in a protocol identifier array. The protocol identifier array represents a protocol tree structure based on a set of nodes with pointers to parent, sibling, and child nodes corresponding to the protocol tree. The pointers include protocol identifier values that correspond to memory offset values with respect to the array. For queried protocol dimensions, the protocol identifier array is used to traverse the protocol tree from the leaf node in the meta-flow to a matching node matching the queried protocol. If the queried protocol is found in the protocol lineage of the meta-flow, the measures for the meta-flow are used to satisfy the query.