The "Trend" is an attempt to put a number to the increase in activity for a given port. Right now, I am comparing the last 24 hours to the last 30 days. So if we see a rise in activity compared to the last 30 days, the trend is high.
The following formula is used to calculate the trend:
sqrt( (S-s)^2/s + (T-t)^2/t ) )
S: number of source IPs hitting this port last 24 hrs.
s: average number of source IPs hitting this port each day (last 30 days).
T/t: same for target IPs detecting scans on this port.
| Port | Trend | Service |
|---|---|---|
| 8009 | 4.1 | |
| 2425 | 2.57 | |
| 646 | 1.76 | |
| 81 | 1.67 | |
| 23 | 1.67 | |
| 1843 | 1.58 | |
| 990 | 1.42 | |
| 9000 | 1.37 | |
| 94 | 1.36 | |
| 44444 | 1.34 | |
| 543 | 1.24 | |
| 556 | 1.14 | |
| 5051 | 1.12 | |
| 544 | 1.12 | |
| 631 | 1.03 | |
| 1222 | 1.02 | |
| 808 | 0.98 | |
| 873 | 0.97 | |
| 5432 | 0.87 | |
| 427 | 0.87 | |
| 7 | 0.86 | |
| 144 | 0.81 | |
| 161 | 0.81 | |
| 465 | 0.79 | |
| 199 | 0.64 | |
| 995 | 0.48 | |
| 37 | 0.38 | |
| 6001 | 0.26 | |
| 3986 | 0.24 | |
| 9100 | 0.03 |