Enhancing Port Scans Attack Detection Using Principal Component Analysis and Machine Learning Algorithms

Baah, Emmanuel Kwesi; Yirenkyi, Steven; Asamoah, Dominic; Oppong, Stephen Opoku; Opoku-Mensah, Edward; Partey, Benjamin Tei; Sackey, Anthony Kingsley; Kornyo, Oliver; Obu, Evans

doi:10.1007/978-981-19-8445-7_8

Cited by 8 publications

(4 citation statements)

References 17 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Six studies out of the 15 study sample experimented with the RF algorithm [20,21,22,23,24,25]. Algorithm performance ranged from 78.09% to 100% across those studies.…”

Section: Random Forestmentioning

confidence: 99%

“…Further, the authors included port scan data from five different port scan tools. Four studies experimented with SVM [20,21,24,25]. All four also had explored RF performance.…”

Section: Random Forestmentioning

confidence: 99%

“…The author used two nmap scan techniques-aggressive (NMAP-A) and stealth (NMAP-S). There were five additional datasets used in three [19,22,21] out of the remaining four studies [24] in this category. Training and evaluation of NB algorithms demonstrated performances in the range of 55% to 99.7%.…”

Section: Naive Bayesmentioning

confidence: 99%

See 2 more Smart Citations

Machine Learning and Port Scans: A Systematic Review

Pittman¹

2023

Preprint

View full text Add to dashboard Cite

Port scanning is the process of attempting to connect to various network ports on a computing endpoint to determine which ports are open and which services are running on them. It is a common method used by hackers to identify vulnerabilities in a network or system. By determining which ports are open, an attacker can identify which services and applications are running on a device and potentially exploit any known vulnerabilities in those services. Consequently, it is important to detect port scanning because it is often the first step in a cyber attack. By identifying port scanning attempts, cybersecurity professionals can take proactive measures to protect the systems and networks before an attacker has a chance to exploit any vulnerabilities. Against this background, researchers have worked for over a decade to develop robust methods to detect port scanning. While there have been various surveys, none have focused solely on machine learning based detection schemes specific to port scans. Accordingly, we provide a systematic review of 15 papers published between February 2021 and January 2023. We extract critical information such as training dataset, algorithm used, technique, and model accuracy. We also collect unresolved challenges and ideas for future work. The outcomes are significant for researchers looking to step off from the latest work and for practitioners interested in novel mechanisms to detect the early stages of cyber attack.

show abstract

“…Six studies out of the 15 study sample experimented with the RF algorithm [20,21,22,23,24,25]. Algorithm performance ranged from 78.09% to 100% across those studies.…”

Section: Random Forestmentioning

confidence: 99%

“…Further, the authors included port scan data from five different port scan tools. Four studies experimented with SVM [20,21,24,25]. All four also had explored RF performance.…”

Section: Random Forestmentioning

confidence: 99%

See 1 more Smart Citation

Machine Learning and Port Scans: A Systematic Review

Pittman¹

2023

Preprint

View full text Add to dashboard Cite

show abstract

“…Centroids that are produced can be used to categorize network activity. 4 [15] Seven machine learning classifiers to identify PortScan attacks after successfully resolving the relevant component and improving the results using principal component analysis. Findings discussion 5 [16] Logistic regression to detect PortScan attacks and tested data balancing methods to achieve better results.…”

Section: Appendix Table 1 Related Workmentioning

confidence: 99%

Machine learning-based PortScan attacks detection using OneR classifier

Kareem,

Jawad Kadhim Abood,

Ibrahim

2023

Bulletin EEI

View full text Add to dashboard Cite

PortScan attacks are a common security threat in computer networks, where an attacker systematically scans a range of network ports on a target system to identify potential vulnerabilities. Detecting such attacks in a timely and accurate manner is crucial to ensure network security. Attackers can determine whether a port is open by sending a detective message to it, which helps them find potential vulnerabilities. However, the best methods for spotting and identifying port scanner attacks are those that use machine learning. One of the most dangerous online threats is PortScan attack, according to experts. The research is work on detection while improving detection accuracy. Dataset containing tags from network traffic is used to train machine learning techniques for classification. The JRip algorithm is trained and tested using the CICIDS2017 dataset. As a consequence, the best performance results for JRip-based detection schemes were 99.84%, 99.80%, 99.80%, and 0.09 ms for accuracy, precision, recall, F-score, and detection overhead, respectively. Finally, the comparison with current models demonstrated our model's proficiency and advantage with increased attack discovery speed.

show abstract

Cyber Digital Twin with Deep Learning Model for Enterprise Products Management

Wang

2024

Wireless Pers Commun

View full text Add to dashboard Cite

Enhancing Port Scans Attack Detection Using Principal Component Analysis and Machine Learning Algorithms

Cited by 8 publications

References 17 publications

Machine Learning and Port Scans: A Systematic Review

Machine Learning and Port Scans: A Systematic Review

Machine learning-based PortScan attacks detection using OneR classifier

Cyber Digital Twin with Deep Learning Model for Enterprise Products Management

Contact Info

Product

Resources

About