Evaluation of passive OS fingerprinting methods using TCP/IP fields

Kód výsledku v IS VaVaI

<a href="https://www.isvavai.cz/riv?ss=detail&h=RIV%2F63839172%3A_____%2F23%3A10133572" target="_blank" >RIV/63839172:_____/23:10133572 - isvavai.cz</a>

Nalezeny alternativní kódy

RIV/68407700:21240/23:00367557

Výsledek na webu

<a href="https://ieeexplore.ieee.org/document/10192974" target="_blank" >https://ieeexplore.ieee.org/document/10192974</a>

DOI - Digital Object Identifier

<a href="http://dx.doi.org/10.23919/SpliTech58164.2023.10192974" target="_blank" >10.23919/SpliTech58164.2023.10192974</a>

Jazyk výsledku

angličtina

Název v původním jazyce

Evaluation of passive OS fingerprinting methods using TCP/IP fields

Popis výsledku v původním jazyce

An important part of network management is to keep knowledge about the connected devices. One of the tools that can provide such information in real-time is passive OS fingerprinting, in particular the method based on analyzing values of specific TCP/IP headers. The state-of-the-art approach is to use machine learning to create such OS classifier. In this paper, we focus on the evaluation of this approach from several perspectives. We took two existing public datasets and created a new one from our network and trained machine learning models to classify the 4 most common operation system families based on selected TCP/IP fields. We compare different models, discuss the need to round TTL values to avoid over-fitting, and test the transferability of models trained on data from different networks. Although TCP/IP-related characteristics of individual operating systems should be independent on where the device is located, our experiments show that a model trained in one network performs much worse in another one, making model creation and deployment more difficult in practice. A good solution may be to combine data from multiple networks. A model trained on a combination of all three datasets exhibited the best results on average across the datasets.

Název v anglickém jazyce

Evaluation of passive OS fingerprinting methods using TCP/IP fields

Popis výsledku anglicky

An important part of network management is to keep knowledge about the connected devices. One of the tools that can provide such information in real-time is passive OS fingerprinting, in particular the method based on analyzing values of specific TCP/IP headers. The state-of-the-art approach is to use machine learning to create such OS classifier. In this paper, we focus on the evaluation of this approach from several perspectives. We took two existing public datasets and created a new one from our network and trained machine learning models to classify the 4 most common operation system families based on selected TCP/IP fields. We compare different models, discuss the need to round TTL values to avoid over-fitting, and test the transferability of models trained on data from different networks. Although TCP/IP-related characteristics of individual operating systems should be independent on where the device is located, our experiments show that a model trained in one network performs much worse in another one, making model creation and deployment more difficult in practice. A good solution may be to combine data from multiple networks. A model trained on a combination of all three datasets exhibited the best results on average across the datasets.

Druh

D - Stať ve sborníku

CEP obor

—

OECD FORD obor

10201 - Computer sciences, information science, bioinformathics (hardware development to be 2.2, social aspect to be 5.8)

Projekt

<a href="/cs/project/VJ02010024" target="_blank" >VJ02010024: Analýza šifrovaného provozu pomocí síťových toků</a><br>

Návaznosti

P - Projekt vyzkumu a vyvoje financovany z verejnych zdroju (s odkazem do CEP)

Rok uplatnění

2023

Kód důvěrnosti údajů

S - Úplné a pravdivé údaje o projektu nepodléhají ochraně podle zvláštních právních předpisů

Název statě ve sborníku

2023 8th International Conference on Smart and Sustainable Technologies (SpliTech)

ISBN

978-953-290-128-3

ISSN

—

e-ISSN

—

Počet stran výsledku

4

Strana od-do

530-533

Název nakladatele

IEEE

Místo vydání

Neuveden

Místo konání akce

Split/Bol, Croatia

Datum konání akce

20. 6. 2023

Typ akce podle státní příslušnosti

WRD - Celosvětová akce

Kód UT WoS článku

—