It would be much easier to match listening ports against known services. Anything else would be suspect. With few exceptions, services run on well-known ports. Others, can usually be assigned fixed ports. In any given organization, the number of active services (ports) is usually much fewer than that which would be found in the services file. It should be possible to generate a list of services that are used in the organization.
There are many ports that are used by both malware and legitmate software. A fair number of the lesser known ports I use show up as malware ports when I research them.
Scanning servers for listening ports (both externally and internally) and matching against expected services could be more effective.