Machine learning-based PortScan attacks detection using OneR classifier - Detection Accuracy Study

Sep 17, 2026

PortScan attacks pose a frequent threat in computer networks by probing and identifying exposed ports that may reveal vulnerabilities. The study develops a machine learning classification approach using the CICIDS2017 network-traffic dataset with feature selection. The OneR-based decision rule is trained and evaluated with the JRip algorithm, reporting strong performance across accuracy, precision, recall, and F-score, alongside low detection overhead. Results are compared with existing models to show higher attack discovery speed and improved detection capability.

LanguageEnglish

CategoryResearch & Report

FormatPDF

Pages7

Reading Time18 min

AccessFree to download

Abstract

1. Introduction

Port scanning as reconnaissance

Network protocols and targets

Motivation for machine learning-based detection

Key steps in machine learning intrusion detection

Related penetration testing context

Machine learning-based PortScan attacks detection using OneR classifier Mohammed Ibrahim Kareem1, Mohammad Jawad Kadhim Abood2, Karrar Ibrahim3 1Department of Information Security, University of Babylon, Hillah, Iraq 2Department of Software, University of Babylon, Hillah, Iraq 3Department of English, College of Education, Al-Zahraa University for Women, Karbala, Iraq Article history: Received May 28, 2022 Revised Jul 14, 2022 Accepted Feb 3, 2023 Keywords: CICIDS2017 Feature selection JRip Machine learning Network security PortScan attack Corresponding Author: PortScan attacks are a common security threat in computer networks, where an attacker systematically scans a range of network ports on a target system to identify potential vulnerabilities. Detecting such attacks in a timely and accurate manner is crucial to ensure network security. Attackers can determine whether a port is open by sending a detective message to it, which helps them find potential vulnerabilities. However, the best methods for spotting and identifying port scanner attacks are those that use machine learning. One of the most dangerous online threats is PortScan attack, according to experts. The research is work on detection while improving detection accuracy. Dataset containing tags from network traffic is used to train machine learning techniques for classification. The JRip algorithm is trained and tested using the CICIDS2017 dataset. As a consequence, the best performance results for JRip-based detection schemes were 99.84%, 99.80%, 99.80%, and 0.09 ms for accuracy, precision, recall, F-score, and detection overhead, respectively. Finally, the comparison with current models demonstrated our model's proficiency and advantage with increased attack discovery speed. This is an open access article under the CC BY-SA license. Mohammed Ibrahim Kareem Department of Information Security, University of Babylon Hillah, Iraq [Email: Mohamed.ibrahim@uobabylon.edu.iq](Email: Mohamed.ibrahim@uobabylon.edu.iq) Article Info ABSTRACT 1. INTRODUCTION The first step in launching a network attack is to identify vulnerable hosts and prospective victims. Port scanning is a common method used by attackers to determine the level of vulnerability in their targets. This is a reconnaissance attack that allows the attacker to collect information about receiving hosts' port numbers, network configurations, server implementations, operating systems, and potential service vulnerabilities. Sending a probe packet to a specific host port on the network and analyzing the answer from an open port is what port scanning entails [1] . Port scanning is typically performed on transmission control protocol (TCP), user datagram protocol (UDP), and internet control message protocol (ICMP) channels. In order to find out which network ports are open and which services are currently using them on a computing endpoint, port scanning is the act of making attempts to connect to multiple network ports on the device. In order to find holes in a system or network, hackers frequently utilize this technique. An attacker can discover the services and apps running on a device and potentially exploit any known vulnerabilities in those services by determining which ports are exposed. Port scanning is frequently the first stage of a cyber-attack, making it crucial to recognize it. Security experts can take proactive steps to secure the systems and networks by spotting port scanning attempts before an attacker has an opportunity to take advantage of any flaws [2] . Scientists have spent a lot of time and energy creating reliable methods for detecting port scanning operations over the past ten years, including machine learning. Machine learning makes use of the capacity to learn from examples or data patterns in order to carry out tasks and gradually improve its performance. Machine learning makes it feasible to distinguish between previously unexpected attacks , regular,

FAQs

What is the main goal of the study on PortScan detection?

To detect PortScan attacks efficiently and accurately using a machine-learning classification approach, improving detection performance and speed.

Which dataset and learning approach are used for training and evaluation?

The study trains and tests the model using the CICIDS2017 dataset, leveraging machine learning with feature selection and rule-based classifiers.

How does the proposed model’s performance compare with existing approaches?

The comparison with current models shows the proposed method has better proficiency and advantage, including increased attack discovery speed and strong metric results.

Sep 17, 2026

Uploaded by River Wang