From: How can sliding HyperLogLog and EWMA detect port scan attacks in IP traffic?
Duration
No. of IP packets
No. of flows
67 min
32.106
250.103