CPC H04L 63/1425 (2013.01) [G06F 16/1734 (2019.01); H04L 12/4641 (2013.01); H04L 43/04 (2013.01); H04L 43/062 (2013.01); H04L 63/1416 (2013.01)] | 20 Claims |
1. A method, comprising:
accessing a first data flow log event in a data flow log;
determining whether the first data flow log event is a request event or a response event by determining whether a first port value is above or below a predetermined threshold or whether a second port value is above or below the predetermined threshold;
generating an identifier for the first data flow log event based on the first data flow log event being the request event or the response event; and
incrementing an event count associated with the identifier.
|