Port Scanning Detection Method Based on Ensemble Learning

Port scanning is an information collection technique for detecting open ports of a target host or target system. Attackers can obtain information about the services running on the host through port scanning, preparing for the next step of the attack. In order to prevent such attacks, machine learning based port scanning detection techniques have emerged in recent years. However, related research usually uses a single machine learning model to identify and detect port scanning attack features, which has limitations in detection effectiveness. This paper proposes an ensemble learning model that integrates the base classifiers such as Decision Tree, Support Vector Machine, Naϊve Bayes and Logistic Regression to balance the interpretability, generalization, and efficiency of the model. The majority voting strategy is used to aggregate the prediction results. The experiment shows that the ensemble model can effectively identify port scanning attacks on the CICIDS2017 dataset and self-collected dataset. The performance of various metrics is higher than that of most selected base classifiers, and the accuracy, F1 score, precision, and false alarm rate can be equal to or better than the performance mean of the base classifiers.