1. A method for detecting unauthorized intrusion in a network system, comprising the steps of: receiving packet level activity information from the network; sorting port specific activity information from the received packet level activity information; monitoring the port specific activity information; and executing at least one of a blocking action or a tracking action based upon the monitored port specific activity information.