Table 6: Average number of containing events for generating the upper level synthetic events.

Events count Size (MB) Average number of containing events
Check fileSequentially file readSequentially file writeRead write file Network connection HTTP connection DNS connection

2279766 253 3 10 9 1 38 5
5420727 753 3 2587 3 375
88728881503 4 11 9 2 380
373283875003 410 26 2445
6896188910003 32067 4 82 0
1405074962000 3 461 16592 5
32886833650003 6 4862334 5
621132167 1000034 34120 442 5