Virtual private cloud flow log event fingerprinting and aggregation

A non-transitory computer-readable storage medium, the computer-readable storage medium including instructions that when executed by a processor, cause the processor to:

• access a first data flow log event in a data flow log;
• determine whether the first data flow log event is a request event or a response event by determining whether a first port value is above or below a predetermined threshold or whether a second port value is above or below the predetermined threshold;
• generate an identifier for the first data flow log event based on the first data flow log event being the request event or the response event;
• and
• increment an event count associated with the identifier.

A computing apparatus comprising:

• a processor;
• and
• a memory storing instructions that, when executed by the processor, cause the processor to:
• access a first data flow log event in a data flow log;
• determine whether the first data flow log event is a request event or a response event by determining whether a first port value is above or below a predetermined threshold or whether a second port value is above or below the predetermined threshold;
• generate an identifier for the first data flow log event based on the first data flow log event being the request event or the response event;
• and
• increment an event count associated with the identifier.