Distributed threat sensor data aggregation and data export

The system as recited in claim 5, wherein to a significance score of the respective significance scores for an individual source of the interactions of the respective individual sources of the interactions, the distributed threat sensor data aggregation and data export service is further configured to:

• determine, based at least in part the aggregated information regarding the interactions over the defined period of time for the individual source, and aggregated information regarding interactions from previous defined periods of time for the individual source, recency information regarding how recently the interactions occurred;
• determine a number of the plurality of threat sensors that the individual source communicated with during at least one of the defined periods of time;
• and
• compute the significance score for the individual source of the interactions based at least in part on the determined recency information and the determined number of threat sensors that the individual source communicated with.

A method, comprising:

• performing by a distributed threat sensor data aggregation and data export component:
• receiving a stream of sensor logs from a plurality of threat sensors, wherein individual logs of the stream of sensor logs comprise information regarding respective interactions with respective threat sensors, and wherein the information includes respective identifiers of the sources of the interactions;
• aggregating, from the stream of sensor logs received from the plurality of threat sensors over a defined period of time, the information regarding the interactions with the threat sensors by the identifiers of the sources of the interactions, into aggregated information regarding the interactions over the defined period of time for the respective individual sources of the interactions;
• computing, based at least in part on the aggregated information regarding the interactions, respective significance scores for the respective individual sources of the interactions, wherein a respective individual significance score comprises a likelihood that the respective individual source is engaging in threatening network communications;
• and
• providing at least some of the respective significance scores, for at least some of the respective individual sources of the interactions, to one or more destinations.

One or more non-transitory computer-readable storage media storing program instructions, that when executed on or across one or more processors of a distributed threat sensor data collection and data export component, cause the one or more processors to:

• receive a stream of sensor logs from a plurality of threat sensors, wherein individual logs of the stream of sensor logs comprise information regarding respective interactions with respective threat sensors, and wherein the information includes respective identifiers of the sources of the interactions;
• aggregate, from the stream of sensor logs received from the plurality of threat sensors over a defined period of time, the information regarding the interactions with the threat sensors by the identifiers of the sources of the interactions, into aggregated information regarding the interactions over the defined period of time for the respective individual sources of the interactions;
• compute, based at least in part on the aggregated information regarding the interactions, respective significance scores for the respective individual sources of the interactions, wherein a respective individual significance score comprises a likelihood that the respective individual source is engaging in threatening network communications;
• and
• provide at least some of the respective significance scores, for at least some of the respective individual sources of the interactions, to one or more destinations.