Adaptive Defense Against Various Network Attacks:

"This paper is much like earlier papers on threshold random walk detection methods used to detect failed connection attempts as well as host and port scans."

(Via worm blog.)