The "Trend" is an attempt to put a number to the increase in activity for a given port. Right now, I am comparing the last 24 hours to the last 30 days. So if we see a rise in activity compared to the last 30 days, the trend is high.
The following formula is used to calculate the trend:
sqrt( (S-s)^2/s + (T-t)^2/t ) )
S: number of source IPs hitting this port last 24 hrs.
s: average number of source IPs hitting this port each day (last 30 days).
T/t: same for target IPs detecting scans on this port.
| Port | Trend | Service |
|---|---|---|
| 545 | 6.44 | |
| 2593 | 5.1 | |
| 3073 | 5.07 | |
| 3105 | 5.07 | |
| 2561 | 4.91 | |
| 2081 | 4.77 | |
| 1521 | 4.55 | |
| 1569 | 3.79 | |
| 1537 | 3.61 | |
| 2049 | 3.15 | |
| 2425 | 3.07 | |
| 3389 | 2.88 | |
| 1057 | 2.47 | |
| 8555 | 2.32 | |
| 33 | 2.31 | |
| 20000 | 2.27 | |
| 8008 | 2.23 | |
| 1843 | 2.06 | |
| 513 | 1.93 | |
| 20001 | 1.89 | |
| 3050 | 1.88 | |
| 65506 | 1.39 | |
| 161 | 1.32 | |
| 2967 | 1.32 | |
| 1 | 1.29 | |
| 8443 | 1.27 | |
| 321 | 1.15 | |
| 995 | 1.13 | |
| 22 | 1 | |
| 7 | 0.94 | |
| 23 | 0.86 | |
| 257 | 0.71 | |
| 8081 | 0.7 | |
| 5269 | 0.56 | |
| 100 | 0.53 | |
| 65 | 0.52 | |
| 445 | 0.51 | |
| 1111 | 0.51 | |
| 1184 | 0.34 | |
| 2023 | 0.32 | |
| 427 | 0.28 | |
| 1625 | 0.23 |