• sans.org(Portal)
• GIAC
• My ISCHow To Submit Logs
• port/ip lookup/search:

The "Trend" is an attempt to put a number to the increase in activity for a given port. Right now, I am comparing the last 24 hours to the last 30 days. So if we see a rise in activity compared to the last 30 days, the trend is high.

The following formula is used to calculate the trend:
sqrt( (S-s)^2/s + (T-t)^2/t ) )
S: number of source IPs hitting this port last 24 hrs.
s: average number of source IPs hitting this port each day (last 30 days).
T/t: same for target IPs detecting scans on this port.

Port	Trend	Service
44444	7.77
556	6.9
7020	3.48
7013	3.41
43	3.32
1843	3.32
7021	3.19
7015	3.12
7014	3.08
7012	3.07
7011	3.06
7003	2.99
1887	2.92
2425	2.87
7006	2.76
7008	2.6
23	2.51
7009	2.45
9999	2.33
7002	2.27
7007	2.23
9000	2.21
7004	2.2
7010	2.09
53	1.98
161	1.84
10000	1.78
7005	1.78
3389	1.61
7373	1.52
3370	1.46
9397	1.26
2967	1.23
8443	1.2
808	1.17
123	1.12
7	1.03
2042	0.92
1207	0.89
1954	0.86
2016	0.85
2023	0.84
94	0.83
1960	0.83
1500	0.82
1946	0.81
1217	0.81
2048	0.81
2046	0.81
2013	0.8
2022	0.79
2017	0.78
1776	0.77
2045	0.77
1967	0.76
1923	0.75
1917	0.74
2012	0.74
1537	0.74
1955	0.74
2019	0.73
2027	0.73
1651	0.72
1957	0.72
1898	0.72
2010	0.72
1231	0.72
2035	0.71
2044	0.71
2033	0.7
2032	0.69
1706	0.69
2047	0.69
2018	0.68
1956	0.66
1920	0.66
1958	0.65
1965	0.65
1236	0.65
1940	0.65
2026	0.65
1863	0.65
1869	0.64
25001	0.64
1879	0.64
1921	0.64
1972	0.64
2021	0.63
1962	0.63
1821	0.63
1932	0.63
2014	0.63
2030	0.63
1916	0.62
2005	0.62
2041	0.62
1888	0.61
1968	0.61
1964	0.61
1926	0.61

---