1. A method, comprising: detecting repetitive connections within a predetermined time period from a source node to a destination node; determining the source node is idle and the repetitive connections indicate suspect activity, wherein the determining includes: determining the repetitive connections include more than a threshold value X of resource identifiers requested by the source node, wherein the threshold value X is selected to indicate a minimum number of connections sufficient for determining whether the source node is idle; determining the repetitive connections include less than a threshold value Y of unique domain names; and determining the repetitive connections include less than a threshold value Z of unique resource identifiers associated with at least one of the unique domain names, wherein the threshold values X, Y and Z are numerical values selected to be indicative of a pattern consistent with connections not generated by a human user; calculating a score for the idle source node based on behavior of the repetitive connections during the predetermined time period; and taking a policy action if the score exceeds a threshold value.