Gravar-mail: Detection of slow port scans in flow-based network traffic