Fig. 11From: OMMA: open architecture for Operator-guided Monitoring of Multi-step AttacksMorwilog execution time vs. number of events in E in . Each point is the average of the result of 50 simulations with the parameters in Table 2Back to article page