Figure 6From: How can sliding HyperLogLog and EWMA detect port scan attacks in IP traffic? Input data: the estimated number of ports over 1- and 5-min sliding windows. Back to article page