from collections import defaultdict

def detect_recon_behavior(connections):
    by_src = defaultdict(set)

    for c in connections:
        by_src[c["src"]].add(c["dport"])

    findings = []
    for src, ports in by_src.items():
        if len(ports) >= 20:
            findings.append({
                "behavior": "MULTI_PORT_ACTIVITY",
                "src": src,
                "port_count": len(ports)
            })

    return findings
