Enhancing Port Scan and DDoS Attack Detection using Genetic and Machine Learning Algorithms

Cybersecurity frameworks accord on reconnaissance being the initial phase undertaken by malicious actors when attacking a system. Among these reconnaissance techniques, port scanning stands out as a powerful tool for gaining deep intelligence about a network and its vulnerabilities. As automated tools continue to evolve in terms of stealth, speed, and the utilization of advanced techniques, traditional defense mechanisms struggle to keep pace. Moreover, port scanning often precedes multi-step attacks, with DDoS attacks being a common subsequent step. DDoS attacks not only inflict significant costs on businesses but also serve as a diversionary tactic, drawing attention and resources away from other security concerns. Studies have addressed the limitations of traditional Intrusion Detection Systems (IDS) with ML. Furthermore, feature selection and reduction methods have been shown to enhance ML-IDS performance. This paper leverages genetic algorithms, a nature-inspired algorithm to improve the model building pipeline. It is used to first select an optimal subset of features capable of efficiently detecting the attacks and secondly to perform Hyper Parameter Optimization. The approach is tested on CICIDS2017, CICIOT2023, and MSCAD datasets to account for different contexts: typical company networks, IoT environments, and multi-step attacks. The approach yielded performance over 95% over all the metrics used (accuracy, precision, F1 score and recall) with a significant reduction in training time. There was also 0 misclassification between the two types of attacks on the CICIDS2017.