Detecting suspicious network activity using flow sampling

A non-transitory computing device readable medium storing instructions for network security executable by a computing device to cause the computing device to:

• receive flow sampled network traffic from a plurality of network devices for network traffic among a plurality of computing devices;
• compare source ports and destination ports in the flow sampled network traffic to a list of approved ports;
• and
• maintain a suspicious network activity list for flow sampled network traffic having source and destination ports exceptional to the list of approved ports.

A network monitoring computing device for network security, comprising:

• memory resources;
• processing resources coupled to the memory resources to:
• compare source ports and destination ports in flow sampled network traffic to a list of approved ports;
• maintain a suspicious network activity list for flow sampled network traffic received from a plurality of network devices, the flow sampled network traffic having source ports and destination ports exceptional to the list of approved ports;
• and
• alert a network administrator when a port is added to the suspicious network activity list in response to a total number of ports in the suspicious network activity list exceeding a threshold number.