Enhancing IoT Security Using Machine Learning for Port Scan Attack Detection

The fast proliferation of the Internet of Things (IoT) has facilitated the highest levels of connectivity, but also has created severe weaknesses, especially reconnaissance attacks, including host and operating system (OS) port scanning. Such attacks provide gateway to even more sophisticated attacks, and therefore it is crucial to detect them early to ensure IoT infrastructures are secured. This paper suggests a framework that could be used to detect port scanning based on the IoTID20 dataset and implemented with machine learning. Eight classifiers, including, XGBoost, Random Forest, Bagging, AdaBoost, Gradient Boosting, CatBoost, LightGBM and Support Vector Machine (SVM) have been used in comparative analysis in terms of Accuracy, Precision, Recall, and F1-score. It is demonstrated that the boosting and ensemble models are much better than the traditional classifiers, with LightGBM demonstrating the best accuracy of 99.90%, precision of 99.91%, recall of 99.87% and F1-score of 99.89%. Near-perfect detection was also observed with bagging (99.87% accuracy) and CatBoost (99.84% accuracy) and the lowest accuracy was observed with SVM (98.37%). These results highlight the power of sophisticated ensemble learning models to identify complex attack patterns in high-dimensional IoT traffic. The combination of these strategies can offer a very strong backbone to the next generation intrusion detection systems that will be able to overcome reconnaissance threat in the IoT networks