Enhancing Port Scans Attack Detection Using Principal Component Analysis and Machine Learning Algorithms

Abstract

Port scanning attacks remain one of the major penetration testing schemes attackers employ to undertake maliferous intentions. With the increasingly sophisticated nature of cyber criminals and advanced technology and the failure of traditional network intrusion detection systems, the challenge of effectively detecting open ports with much efficiency in minimal time continues to linger. Thus, several recent studies, particularly those that employed machine learning approaches, have attempted to resolve and address the issue of enhancing this intrusion detection technique, yet suffer many performance challenges demanding further investigation. This paper employed seven machine learning classifiers to detect port scanning attacks after successfully using principal component analysis to resolve the relevant component and enhance the results. Comparison is made between the outcome of the various models and previous studies using accuracy, precision, recall, area-under-curve, f1-score, false-positive rate, and training time as performance metrics. Our results indicate that XGBoost was the best classifier with the highest accuracy of 99.98%, no false positive detected, a precision of 99.99%, a recall of 99.98, and an area-under-curve of 99.99% compared with the other classifiers and previous studies on port scan attack detection.