The "Trend" is an attempt to put a number to the increase in activity for a given port. Right now, I am comparing the last 24 hours to the last 30 days. So if we see a rise in activity compared to the last 30 days, the trend is high.
The following formula is used to calculate the trend:
sqrt( (S-s)^2/s + (T-t)^2/t ) )
S: number of source IPs hitting this port last 24 hrs.
s: average number of source IPs hitten this port each day (last 30 days).
T/t: same for target IPs detecting scans on this port.
| Port | Trend |
|---|---|
| 9788 | 2.15 |
| 26310 | 1.83 |
| 2967 | 1.38 |
| 9988 | 0.83 |
| 23 | 0.83 |
| 9920 | 0.76 |
| 8009 | 0.65 |