Adaptive Divergence-Based Detection of Port Scanning Attacks in Network Traffic

Abstract

Port scanning is one of the most common reconnaissance techniques used by attackers to identify active hosts, open ports, and vulnerable services before launching more complex cyberattacks. Traditional rule-based and static threshold-based detection methods often fail to maintain reliable performance in dynamic network environments, especially under variable traffic loads and low-rate scanning behavior. This paper proposes an adaptive divergence-based approach for detecting port scanning attacks in network traffic. The proposed method models network traffic as a time-dependent stream and analyzes it using sliding observation windows. Within each window, probability distributions of destination ports, source IP addresses, and protocol types are constructed and compared with a baseline normal traffic profile using Jensen-Shannon Divergence. The resulting divergence score represents the statistical deviation of current traffic from normal behavior. To avoid manual parameter selection, a Multi-Armed Bandit mechanism based on Thompson Sampling is introduced to dynamically optimize the sliding window size and threshold sensitivity coefficient. Suspicious traffic segments identified by the adaptive divergence layer are further classified using a Random Forest classifier. The proposed framework combines statistical divergence analysis, adaptive parameter optimization, and machine learning-based classification to improve detection robustness, reduce false alarms, and support real-time intrusion detection. The approach is suitable for detecting port scanning activities in dynamic and high-throughput network environments.