Reproducing Random Forest Efficacy in Detecting Port Scanning
- URL: http://arxiv.org/abs/2302.09317v1
- Date: Sat, 18 Feb 2023 12:28:53 GMT
- Title: Reproducing Random Forest Efficacy in Detecting Port Scanning
- Authors: Jason M. Pittman
- Abstract summary: Port scanning is a method used by hackers to identify vulnerabilities in a network or system.
It is important to detect port scanning because it is often the first step in a cyber attack.
Researchers have worked for over a decade to develop robust methods to detect port scanning.
- Score: 0.0
- License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/
- Abstract: Port scanning is the process of attempting to connect to various network
ports on a computing endpoint to determine which ports are open and which
services are running on them. It is a common method used by hackers to identify
vulnerabilities in a network or system. By determining which ports are open, an
attacker can identify which services and applications are running on a device
and potentially exploit any known vulnerabilities in those services.
Consequently, it is important to detect port scanning because it is often the
first step in a cyber attack. By identifying port scanning attempts,
cybersecurity professionals can take proactive measures to protect the systems
and networks before an attacker has a chance to exploit any vulnerabilities.
Against this background, researchers have worked for over a decade to develop
robust methods to detect port scanning. One such method revealed by a recent
systematic review is the random forest supervised machine learning algorithm.
The review revealed six existing studies using random forest since 2021.
Unfortunately, those studies each exhibit different results, do not all use the
same training and testing dataset, and only two include source code.
Accordingly, the goal of this work was to reproduce the six random forest
studies while addressing the apparent shortcomings. The outcomes are
significant for researchers looking to explore random forest to detect port
scanning and for practitioners interested in reliable technology to detect the
early stages of cyber attack.
Related papers
- Revealing the Black Box of Device Search Engine: Scanning Assets, Strategies, and Ethical Consideration [24.74127068662522]
This study presents the first comprehensive examination of device search engines' operational and ethical dimensions.
We developed a novel framework to trace the IP addresses utilized by these engines and collected 1,407 scanner IPs.
Our findings reveal significant ethical concerns, including a lack of transparency, harmlessness, and anonymity.
arXiv Detail & Related papers (2024-12-20T09:15:48Z) - When Authentication Is Not Enough: On the Security of Behavioral-Based Driver Authentication Systems [53.2306792009435]
We develop two lightweight driver authentication systems based on Random Forest and Recurrent Neural Network architectures.
We are the first to propose attacks against these systems by developing two novel evasion attacks, SMARTCAN and GANCAN.
Through our contributions, we aid practitioners in safely adopting these systems, help reduce car thefts, and enhance driver security.
arXiv Detail & Related papers (2023-06-09T14:33:26Z) - An anomaly detection approach for backdoored neural networks: face
recognition as a case study [77.92020418343022]
We propose a novel backdoored network detection method based on the principle of anomaly detection.
We test our method on a novel dataset of backdoored networks and report detectability results with perfect scores.
arXiv Detail & Related papers (2022-08-22T12:14:13Z) - Prepare for Trouble and Make it Double. Supervised and Unsupervised
Stacking for AnomalyBased Intrusion Detection [4.56877715768796]
We propose the adoption of meta-learning, in the form of a two-layer Stacker, to create a mixed approach that detects both known and unknown threats.
It turns out to be more effective in detecting zero-day attacks than supervised algorithms, limiting their main weakness but still maintaining adequate capabilities in detecting known attacks.
arXiv Detail & Related papers (2022-02-28T08:41:32Z) - Early Detection of Network Attacks Using Deep Learning [0.0]
A network intrusion detection system (IDS) is a tool used for identifying unauthorized and malicious behavior by observing the network traffic.
We propose an end-to-end early intrusion detection system to prevent network attacks before they could cause any more damage to the system under attack.
arXiv Detail & Related papers (2022-01-27T16:35:37Z) - Check Your Other Door! Establishing Backdoor Attacks in the Frequency
Domain [80.24811082454367]
We show the advantages of utilizing the frequency domain for establishing undetectable and powerful backdoor attacks.
We also show two possible defences that succeed against frequency-based backdoor attacks and possible ways for the attacker to bypass them.
arXiv Detail & Related papers (2021-09-12T12:44:52Z) - Increasing the Confidence of Deep Neural Networks by Coverage Analysis [71.57324258813674]
This paper presents a lightweight monitoring architecture based on coverage paradigms to enhance the model against different unsafe inputs.
Experimental results show that the proposed approach is effective in detecting both powerful adversarial examples and out-of-distribution inputs.
arXiv Detail & Related papers (2021-01-28T16:38:26Z) - Dos and Don'ts of Machine Learning in Computer Security [74.1816306998445]
Despite great potential, machine learning in security is prone to subtle pitfalls that undermine its performance.
We identify common pitfalls in the design, implementation, and evaluation of learning-based security systems.
We propose actionable recommendations to support researchers in avoiding or mitigating the pitfalls where possible.
arXiv Detail & Related papers (2020-10-19T13:09:31Z) - A Review of Computer Vision Methods in Network Security [11.380790116533912]
Network security has become an area of significant importance more than ever.
Traditional machine learning methods have been frequently used in the context of network security.
Recent years witnessed a phenomenal growth in computer vision mainly driven by the advances in the area of convolutional neural networks.
arXiv Detail & Related papers (2020-05-07T08:29:11Z) - Survey of Network Intrusion Detection Methods from the Perspective of
the Knowledge Discovery in Databases Process [63.75363908696257]
We review the methods that have been applied to network data with the purpose of developing an intrusion detector.
We discuss the techniques used for the capture, preparation and transformation of the data, as well as, the data mining and evaluation methods.
As a result of this literature review, we investigate some open issues which will need to be considered for further research in the area of network security.
arXiv Detail & Related papers (2020-01-27T11:21:05Z)
This list is automatically generated from the titles and abstracts of the papers in this site.
This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.