# A Systematic Literature Review on Penetration Testing in Networks: Future Research Directions
## 3 Literature Review
### Techniques for Protecting Open Ports against Vulnerabilities
Suricata and PSAD have better performance when used as a network IDS. Portsentry cannot defend against brute force attacks, but it can defend against port scanning attacks and prevent denial-of-service attacks. The authors hope to test more new parameters in the future. [PERSON] et al. [9] proposed a system for detecting, fixing, and reporting security vulnerabilities in local area networks to prevent attacks. The system is primarily intended for Linux/Windows network administrators. It was also developed in Python and is supported by Kali Linux. The authors discussed that there are many tools that can be used to find logically open ports, such as Sparta, OpenVAS, Nessus, and Nmap, but there are no tools used for physically open ports. The proposed tool, the fixing network security vulnerability tool (FNSV), can scan and secure physically open ports using a series of Telnet and SSH commands. In addition, it can scan various vulnerabilities in a network, website, or system and scan a specific IP address or range of IP addresses. It can be used in various network scenarios. [PERSON], [PERSON], and [PERSON] [33] discussed that port scans can be used as an attack and cause problems with application performance and productivity. The authors illustrated how sequential neural networks (NNs) are used to classify packets, separate TCP datagrams, identify the type of TCP packets, and detect port scans. The authors noted that NNs are flexible and can learn from different environments and partition complex tasks. This helps in protocol classification and achieves accuracy rates of over 99 percent. It is effective in detecting TCP port scan attacks. [PERSON], [PERSON], [PERSON], [PERSON] [34] suggested using the intrusion detection and prevention system (IDPS) Snort to mitigate network attacks. The authors created Snort-IDS rules for various DoS and port scan attacks. The results showed that for a TCP reset, Xmas tree, UDP flood, SYN flood, DNS flood, ICMP flood, and Smurf attacks, the percentage of detected attack packets was 98 percent. In addition, for the ACK scan and null scan, the percentage of attack packets detected was 100 percent. In the future, the authors will introduce the Snort-IDS rules to detect other types of attacks. [PERSON], [PERSON] et al. [35] discussed a new port scanning system IPS for SDN based on OpenFlow switch counter data to prevent port scanning attacks. The authors first detected port scan flows and then updated the OpenFlow routing rules to ensure network security. This method was very effective at detecting malicious flows and had a low false negative rate. The system was lightweight and considered resource consumption such as network bandwidth and memory usage. For future work, the authors will use this technique to detect other attacks such as DoS. [PERSON], [PERSON] et al. [36] discussed open ports in Android apps and their threats by opening a port analysis pipeline that included discovery, diagnosis, and security assessments. The study spanned a 10-month period. The researchers collected more than 40 million port monitoring records. In the discovery phase, they used crowdsourcing, which provided a more detailed view of the prevalence of open ports in Android apps. Then, in the diagnosis phase, they used static analysis to obtain more detailed information about the security impact of the open ports. Finally, they conducted security assessments of open ports, namely a vulnerability analysis in a denial-of-service attack assessment and inter-device connectivity measurement. They proposed solutions to mitigate the open port attack in Android. They are app developers, SDK vendors, system vendors, and network operators. The study by [PERSON], [PERSON], et al. [37] aimed to provide an overview of attacks on SCADA (supervisory control and data acquisition) systems, focusing on systems that use Modbus TCP.