CONNECTIONLESS PORT SCAN DETECTION ON A NETWORK

A system and a method for detecting port scanning activities on a computer network. A probability variable is assigned to a device on a computer network. The probability variable indicates the probability that the device is conducting port-scanning activities. Data describing transmissions by the device during multiple intervals of time is accessed, and, for each of the time intervals, a determination is made concerning whether or not the device conducted port-scanning activities. Based on these determinations, the probability variable is updated for each of the time intervals.