# US 11,909,753 B2 · Virtual private cloud flow log event fingerprinting and aggregation > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,909,753 B2 - Document ID: US11909753B2 - Status: Granted - Kind: B2 - Application number: 18/070,137 - Filed: 2022-11-28 - Published: 2023-03-23 - Granted: 2024-02-20 - Earliest claimed: 2019-05-08 - Assignees: Capital One Services, LLC - Applicants: Capital One Services, LLC - Inventors: Seth Patrick Carroll - Web page: https://patentgrep.com/patent/US11909753B2 ## CPC - G06F 16/188: Virtual file systems - H04L 63/1425: {Traffic logging, e.g. anomaly detection} - G06F 16/1734: {Details of monitoring file system events, e.g. by the use of hooks, filter drivers, logs} - H04L 12/4625: {Single bridge functionality, e.g. connection of two networks over a single bridge} - H04L 12/4641: {Virtual LANs, VLANs, e.g. virtual private networks [VPN] (LAN interconnection over a bridge based backbone H04L12/462; encapsulation techniques H04L12/4633; routing of packets H04L45/00; packet switches H04L49/00; virtual private networks for security H04L63/0272)} - H04L 43/026: using flow identification - H04L 43/04: Processing captured monitoring data, e.g. for logfile generation - H04L 43/062: related to network traffic - H04L 43/0823: Errors, e.g. transmission errors - H04L 63/1416: {Event detection, e.g. attack signature detection} - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Techniques for fingerprinting and aggregating a virtual private cloud (VPC) flow log stream are provided. Each VPC flow log event in the VPC flow log is first determined to be a request event or a response event. A fingerprint is then generated for each VPC flow log event. The fingerprint for a VPC flow log event is generated based on the determination whether the VPC flow log event is a request event or a response event and by concatenating and encoding data contained in a set of data fields corresponding to the VPC flow log event. Based on the fingerprint generated for each VPC flow log event, related events can be detected and aggregated to form an aggregated event. Information stored with each aggregated event can then be used to better monitor the VPC. ## Claims ### Claim 1 A method, comprising: accessing a first data flow log event in a data flow log; determining whether the first data flow log event is a request event or a response event by determining whether a first port value is above or below a predetermined threshold or whether a second port value is above or below the predetermined threshold; generating an identifier for the first data flow log event based on the first data flow log event being the request event or the response event; and incrementing an event count associated with the identifier. ### Claim 2 (depends on 1) The method of claim 1, further comprising: incrementing a byte count associated with the identifier based on a number of bytes associated with the first data flow log event. ### Claim 3 (depends on 1) The method of claim 1, further comprising: determining that a second data flow log event in the data flow log is associated with the identifier. ### Claim 4 (depends on 3) The method of claim 3, further comprising: consolidating the first and second data flow log events in the data flow log based on the first and second data flow log events being associated with the identifier. ### Claim 5 (depends on 3) The method of claim 3, further comprising: displaying the consolidated first and second data flow log events in the data flow log. ### Claim 6 (depends on 1) The method of claim 1, wherein the identifier comprises a fingerprint, wherein the fingerprint is based on hashing one or more of: a client interface identifier of the first data flow log event, a source address of the first data flow log event, a destination address of the first data flow log event, a communication protocol identifier of the first data flow log event, an action identifier of the first data flow log event, the first port value, and the second port value. ### Claim 7 (depends on 1) The method of claim 1, wherein a first one of the first port value and the second port value is a source port value, wherein a second one of the first port value and the second port value is a destination port value. ### Claim 8 A non-transitory computer-readable storage medium, the computer-readable storage medium including instructions that when executed by a processor, cause the processor to: access a first data flow log event in a data flow log; determine whether the first data flow log event is a request event or a response event by determining whether a first port value is above or below a predetermined threshold or whether a second port value is above or below the predetermined threshold; generate an identifier for the first data flow log event based on the first data flow log event being the request event or the response event; and increment an event count associated with the identifier. ### Claim 9 (depends on 8) The computer-readable storage medium of claim 8, wherein the instructions further cause the processor to: increment a byte count associated with the identifier based on a number of bytes associated with the first data flow log event. ### Claim 10 (depends on 8) The computer-readable storage medium of claim 8, wherein the instructions further cause the processor to: determine that a second data flow log event in the data flow log is associated with the identifier. ### Claim 11 (depends on 10) The computer-readable storage medium of claim 10, wherein the instructions further cause the processor to: consolidate the first and second data flow log events in the data flow log based on the first and second data flow log events being associated with the identifier. ### Claim 12 (depends on 10) The computer-readable storage medium of claim 10, wherein the instructions further cause the processor to: display the consolidated first and second data flow log events in the data flow log. ### Claim 13 (depends on 8) The computer-readable storage medium of claim 8, wherein the identifier comprises a fingerprint, wherein the fingerprint is based on hashing one or more of: a client interface identifier of the first data flow log event, a source address of the first data flow log event, a destination address of the first data flow log event, a communication protocol identifier of the first data flow log event, an action identifier of the first data flow log event, the first port value, and the second port value. ### Claim 14 (depends on 8) The computer-readable storage medium of claim 8, wherein a first one of the first port value and the second port value is a source port value, wherein a second one of the first port value and the second port value is a destination port value. ### Claim 15 A computing apparatus comprising: a processor; and a memory storing instructions that, when executed by the processor, cause the processor to: access a first data flow log event in a data flow log; determine whether the first data flow log event is a request event or a response event by determining whether a first port value is above or below a predetermined threshold or whether a second port value is above or below the predetermined threshold; generate an identifier for the first data flow log event based on the first data flow log event being the request event or the response event; and increment an event count associated with the identifier. ### Claim 16 (depends on 15) The computing apparatus of claim 15, wherein the instructions further cause the processor to: increment a byte count associated with the identifier based on a number of bytes associated with the first data flow log event. ### Claim 17 (depends on 15) The computing apparatus of claim 15, wherein the instructions further cause the processor to: determine that a second data flow log event in the data flow log is associated with the identifier. ### Claim 18 (depends on 17) The computing apparatus of claim 17, wherein the instructions further cause the processor to: consolidate the first and second data flow log events in the data flow log based on the first and second data flow log events being associated with the identifier. ### Claim 19 (depends on 17) The computing apparatus of claim 17, wherein the instructions further cause the processor to: display the consolidated first and second data flow log events in the data flow log. ### Claim 20 (depends on 15) The computing apparatus of claim 15, wherein the identifier comprises a fingerprint, wherein the fingerprint is based on hashing one or more of: a client interface identifier of the first data flow log event, a source address of the first data flow log event, a destination address of the first data flow log event, a communication protocol identifier of the first data flow log event, an action identifier of the first data flow log event, the first port value, and the second port value.