Honeypot network management based on probabilistic detection of malicious port activity

A system comprising:

• one or more computing devices that implement an anomaly detection and remediation (ADR) server, configured to:
• receive a honeypot dataset associated with a honeypot network, wherein the honeypot dataset comprises one or more connections to at least one or more ports of one or more honeypots in the honeypot network over a period of time;
• determine a number of connections to a port of the one or more ports over the period of time;
• determine that the number of connections is associated with malicious activity based on a probability of a deviation of the number of connections from a historical average of the number of connections based on an expected probability distribution according to a discrete probability distribution function configured for the port;
• identify one or more malicious computing devices associated with the malicious activity;
• modify one or more intrusion detection rules or intrusion alert triggers based on the malicious activity and the one or more malicious computing devices;
• and
• perform a remediation operation on one or more computer devices in response to the determination that the number of connections is associated with malicious activity, wherein the remediation operation includes one or more of preventing access to or exfiltration from the one or more computer devices or generating a security workflow for vulnerability assessment of the one or more computer devices.