A system and method for handling Voice over Internet Protocol (VoIP) traffic flows on a computer network, and, in particular, encrypted VoIP traffic flows. The method including: collecting traffic flow data with respect to an IP session; collecting parameters associated with the IP session; determining whether the IP session is a VoIP session; correlating IP sessions having similar parameters to the collected parameters; and creating at least one Internet Protocol Detail Record (IPDR) or Call Detail Record (CDR) based on the correlated IP sessions. The system including: a collection module configured to collect traffic flow data; an analysis module configured to determine parameters and determine whether the IP session is a VoIP session; and a correlation module configured to correlate IP sessions having similar parameters; and create at least one Internet Protocol Detail Record (IPDR) or Call Detail Record (CDR) based on the correlated IP sessions.