Automatically detect anomalies in port scan reports

I run a high security network which needs daily port scans. So I run nmap for port scanning daily and log the output to a logfile.

Now I wanna find out if there is a "suspicious" log file, which means it differs from most of the other saved log files (for example, suddenly port 9999 is open in the report which wasn't the case in 90% of the other log files).

Important is here that I need a bit of tolerance, because the log files are not always static, which makes sense because sometimes devices connect to the network (like smartphones) but this happens also kind of habitual so in 100 datasets there will be a habit visible.

I have already normalized all data and converted it into a two dimensional array, what would be the next step for me now? Does it make sense to use machine learning / neural networks or would that be an overkill? I'm not the best programmer so having an example would be awesome.