What represent the Aggregate Address in Chart?

Please answer............

When you generate a chart from chart scheduler with top attacked IP addresses and a chart make with your own for the same time has a lot of differences?

Can anyone explain why?

If a single user causes multiple violations over time in an ongoing attack, this transaction is correlated into a single aggregated event: If an event exists whose last violation is within the time window from the same client IP address, correlation occurs with the existing event. If many transactions are occurring in the same part of the application, either a distributed attack or a false positive has occurred. If an event exists whose last violation is within the time window for the same URL+parameter combination, correlation occurs with the existing event. If no such event exists, a new event begins.