Patent attributes
Techniques for fingerprinting and aggregating a virtual private cloud (VPC) flow log stream are provided. Each VPC flow log event in the VPC flow log is first determined to be a request event or a response event. A fingerprint is then generated for each VPC flow log event. The fingerprint for a VPC flow log event is generated based on the determination whether the VPC flow log event is a request event or a response event and by concatenating and encoding data contained in a set of data fields corresponding to the VPC flow log event. Based on the fingerprint generated for each VPC flow log event, related events can be detected and aggregated to form an aggregated event. Information stored with each aggregated event can then be used to better monitor the VPC.
