Detecting an internal host that has attempted to reach a large number of internal IP addresses, but on a small number of ports.
