1. A method, comprising: detecting repetitive connections from an idle source node to a destination node; calculating a score for the idle source node based on behavior of the repetitive connections; taking a policy action if the score exceeds a threshold value.