This event refers to new services been used in the network. For each host in the network, Hogzilla IDS keeps information about the accessed (and open in these hosts) TCP ports. Hogzilla generates alerts whenever there are sFlows pointing out access to new ports on these hosts.
It may be a backdoor or an unauthorized access!