Leveraging ACO, GA, and GWO for Enhancing Port Scan Attack Detection Using Machine Learning

Port scan attacks are commonly employed by malicious actors or automated tools to probe a system’s network ports in search of open ports and potential vulnerabilities. These ports function as communication endpoints that allow services and applications to exchange data. While port scanning is often associated with malicious intent—such as mapping network structures, identifying running services, or preparing for subsequent attacks—it is not always harmful. In fact, cybersecurity professionals and system administrators regularly use port scanning as a diagnostic tool to identify and address system weaknesses. To protect against port scan attacks, organizations typically deploy a combination of firewalls, intrusion detection systems (IDS), and network monitoring tools to detect and block unauthorized scanning activities. Detecting port scans is a vital part of cybersecurity defense, enabling organizations to identify points of vulnerability, respond swiftly to incidents, and implement appropriate security measures. This proactive approach significantly reduces the risk of successful cyber intrusions. In our research, we propose a machine learning-based approach for detecting port scan attacks. The process begins with data collection, where network traffic data containing behavioral indicators of scanning activity is gathered. From this data, relevant features are extracted to train the model. Feature selection is then performed using metaheuristic algorithms such as Ant Colony Optimization (ACO), Genetic Algorithm (GA), and Gray Wolf Optimization (GWO), which help reduce computational complexity by selecting the most informative features. These selected features are then used to train machine learning models, including classifiers like Support Vector Machine (SVM) and K-Nearest Neighbors (KNN), to differentiate between benign and malicious activity. Finally, the performance of the trained models is assessed using evaluation metrics such as precision, recall, F1-score, and accuracy. The results of our experiments indicate that the proposed models are highly effective, achieving accuracy rates exceeding 99% across all tested configurations. In summary, port scan detection is essential for strengthening network defenses. By leveraging machine learning techniques and optimization-based feature selection, it is possible to detect and respond to port scanning behaviors with greater accuracy and efficiency.