core.clj

(def my-keys ["bytesRcvd" "bytesRcvdLoc" "bytesRcvdFromRem" "bytesSentLoc"
              "bytesSentRem" "bytesSent"])

(defn find-ip-keys [m]
  (let [ip-pattern #"[\d\.]+"]
    (select-keys m (map keyword (filter #(re-find ip-pattern %)
                                        (map name (keys m)))))))

(defn get-conn-info [key-coll m]
  (let [keys-sought (map keyword key-coll)
        ip-keys (find-ip-keys (:value m))]
    (for [k (keys ip-keys)]
      {k (select-keys (k ip-keys) keys-sought)})))

(reduce into {} (get-conn-info my-keys ntop-map))