Towards Identification of Operating Systems from the Internet Traffic. IPFIX Monitoring with Fingerprinting and Clustering

Result code in IS VaVaI

<a href="https://www.isvavai.cz/riv?ss=detail&h=RIV%2F00216305%3A26230%2F14%3APU112002" target="_blank" >RIV/00216305:26230/14:PU112002 - isvavai.cz</a>

Result on the web

<a href="http://www.fit.vutbr.cz/research/pubs/all.php?id=10642" target="_blank" >http://www.fit.vutbr.cz/research/pubs/all.php?id=10642</a>

DOI - Digital Object Identifier

<a href="http://dx.doi.org/10.5220/0005099500210027" target="_blank" >10.5220/0005099500210027</a>

Result language

angličtina

Original language name

Towards Identification of Operating Systems from the Internet Traffic. IPFIX Monitoring with Fingerprinting and Clustering

Original language description

This paper deals with identification of operating systems (OSs) from the Internet traffic. Every packet injected on the network carries a specific information in its packet header that reflects the initial settings of a host's operating system. The set of such features forms a fingerprint. The OS fingerprint usually includes an initial TTL time, a TCP initial window time, a set of specific TCP options, and other values obtained from IP and TCP headers. Identification of OSs can be useful for monitoring a traffic   on a local network  and also for security purposes. In our paper we  focus on the passive fingerprinting using TCP SYN packets that is   incorporated to a IPFIX probe. Our tool enhances standard IPFIX records by additional information about OSs. Then, it sends the records to an IPFIX collector where network statistics are stored and presented to the network administrator. If identification is not successful, a further HTTP header check is employed and the fingerprinting database in the probe is updated. Our fingerprinting technique can be extended using cluster analysis as presented in this paper. As we show the clustering adds flexibility and dynamics to the fingerprinting. We also discuss the impact of IPv6 protocol on the passive fingerprinting.  

Czech name

—

Czech description

—

Type

D - Article in proceedings

CEP classification

—

OECD FORD branch

20206 - Computer hardware and architecture

Project

<a href="/en/project/VG20102015022" target="_blank" >VG20102015022: Modern tools for detection and mitigation of cyber criminality on the New Generation Internet</a><br>

Continuities

P - Projekt vyzkumu a vyvoje financovany z verejnych zdroju (s odkazem do CEP)

Publication year

2014

Confidentiality

S - Úplné a pravdivé údaje o projektu nepodléhají ochraně podle zvláštních právních předpisů

Article name in the collection

DCNET2014. Proceedings of the 5th International Conference on Data Communication Networking

ISBN

978-989-758-042-0

ISSN

—

e-ISSN

—

Number of pages

7

Pages from-to

21-27

Publisher name

SciTePress - Science and Technology Publications

Place of publication

Wien

Event location

Wien

Event date

Aug 28, 2014

Type of event by nationality

WRD - Celosvětová akce

UT code for WoS article

—