Port scanning is the process of attempting to connect to various network
ports on a computing endpoint to determine which ports are open and which
services are running on them. It is a common method used by hackers to identify
vulnerabilities in a network or system. By determining which ports are open, an
attacker can identify which services and applications are running on a device
and potentially exploit any known vulnerabilities in those services.
Consequently, it is important to detect port scanning because it is often the
first step in a cyber attack. By identifying port scanning attempts,
cybersecurity professionals can take proactive measures to protect the systems
and networks before an attacker has a chance to exploit any vulnerabilities.
Against this background, researchers have worked for over a decade to develop
robust methods to detect port scanning. While there have been various surveys,
none have focused solely on machine learning based detection schemes specific
to port scans. Accordingly, we provide a systematic review of 15 papers
published between February 2021 and January 2023. We extract critical
information such as training dataset, algorithm used, technique, and model
accuracy. We also collect unresolved challenges and ideas for future work. The
outcomes are significant for researchers looking to step off from the latest
work and for practitioners interested in novel mechanisms to detect the early
stages of cyber attack.