Found the following after discussing the Snooper model for predicting "a run on this port was made on $Date" and I suspect it MAY, possibly, be worth considering for alert thingbobs in NOCtool:
http://www.usenix.org/events/lisa2000/full_papers/brutlag/brutlag_html/index...
//Ingvar