公开(公告)号：US11689545B2

公开(公告)日：2023-06-27

申请号：US17151142

申请日：2021-01-16

Applicant: VMware, Inc.

Inventor： Zhen Mo ,  Ereli Eran ,  Barak Raz ,  Vijay Ganti

IPC: H04L9/40

CPC classification number: H04L63/1416 ,  H04L63/0263 ,  H04L63/1441 ,  H04L63/20

Abstract: The disclosure herein describes automatically performing security operations associated with a client system based on aggregated event impact scores of computing events during a rolling time interval. Event data is obtained, wherein the event data is from a plurality of computing devices of the client system associated with computing events occurring during a time interval after an endpoint of the rolling time interval. Event impact scores are calculated for the computing events of the obtained event data over the time interval based at least on cardinality estimation. The calculated event impact scores are merged into the set of aggregated event impact scores associated with the rolling time interval and event impact scores associated with an expired time interval are removed from the set of aggregated event impact scores. Based on the set of aggregated event impact scores, at least one security operation is performed for at least one computing event.