PHP NetFlow anomaly detector