The "Trend" is an attempt to put a number to the increase in activity for a given port. Right now, I am comparing the last 24 hours to the last 30 days. So if we see a rise in activity compared to the last 30 days, the trend is high.
The following formula is used to calculate the trend:
sqrt( (S-s)^2/s + (T-t)^2/t ) )
S: number of source IPs hitting this port last 24 hrs.
s: average number of source IPs hitten this port each day (last 30 days).
T/t: same for target IPs detecting scans on this port.
| Port | Trend |
|---|---|
| 411 | 26.93 |
| 20001 | 9.88 |
| 11011 | 7.18 |
| 2620 | 6.42 |
| 2508 | 6.35 |
| 2449 | 6.31 |
| 10001 | 5.08 |
| 32001 | 4.59 |
| 49401 | 3.75 |
| 6666 | 3.37 |
| 20000 | 3.22 |
| 8383 | 3.19 |
| 553 | 3.06 |
| 8001 | 2.66 |
| 49400 | 2.6 |
| 51413 | 2.47 |
| 9151 | 2.35 |
| 3050 | 1.84 |
| 808 | 1.79 |
| 9920 | 1.62 |
| 9978 | 1.47 |
| 1028 | 1.47 |
| 22 | 1.41 |
| 9988 | 1.29 |
| 1858 | 1.29 |
| 25402 | 1.29 |
| 1808 | 1.22 |
| 33434 | 1.09 |
| 8088 | 1.01 |
| 25 | 0.98 |
| 18640 | 0.91 |
| 9788 | 0.91 |
| 62000 | 0.87 |
| 1027 | 0.8 |
| 17153 | 0.79 |
| 2301 | 0.78 |
| 61388 | 0.68 |
| 38975 | 0.55 |
| 22736 | 0.49 |
| 67 | 0.23 |