Atypical number of pairs in the period

Hogzilla IDS monitors the number of distinct pairs each host use to communicate in the period of 6 hours. An alert is send if a host communicates with an atypical number of pairs.

The event may refer to an abused host or a malware activity.