A Machine-Learning-Based Tool for Passive OS Fingerprinting With TCP Variant as a Novel Feature

Abstract

With the emergence of Internet of Things (IoT), securing and managing large, complex enterprise network infrastructure requires capturing and analyzing network traffic traces in real-time. An accurate passive Operating System (OS) fingerprinting plays a critical role in effective network management and cybersecurity protection. Passive fingerprinting doesn't send probes that introduce extra load to the network and hence it has a clear advantage over active fingerprinting since it also reduces the risk of triggering false alarms. This paper proposes and evaluates an advanced classification approach to passive OS fingerprinting by leveraging state-of-the-art classical machine learning and deep learning techniques. Our controlled experiments on benchmark data, emulated and realistic traffic is performed using two approaches. Through an Oracle-based machine learning approach, we found that the underlying TCP variant is an important feature for predicting the remote OS. Based on this observation, we develop a sophisticated tool for OS fingerprinting that first predicts the TCP flavor using passive traffic traces and then uses this prediction as an input feature for another machine learning algorithm for predicting the remote OS from passive measurements. This paper takes the passive fingerprinting problem one step further by introducing the underlying predicted TCP variant as a distinguishing feature. In terms of accuracy, we empirically demonstrate that accurately predicting the TCP variant has the potential to boost the evaluation performance from 84% to 94% on average across all our validation scenarios and across different types of traffic sources. We also demonstrate a practical example of this potential, by increasing the performance to 91.3% and 95.22% on average using a tool for loss-based and a combination of loss and delay-based TCP variant prediction in an emulated setting. To the best of our knowledge, this is the first study that explores the potential for using the knowledge of the TCP variant to significantly boost the accuracy of passive OS fingerprinting.

Passive Operating System Fingerprinting Revisited: Evaluation and Current Challenges

“…The datasets and the research works were published between 2018 and 2020 and should accurately represent current real-world network traffic as the datasets contain network flow capture from large-scale campus network including the OS labels from various OS detection techniques up to the minor OS version detail level. The datasets were recently used by Fan et al [53], Hagos et al [72,73], and Zhang et al [91] from different research groups, which indicates the usability of the dataset. Moreover, the usability of the datasets is supported by more the 500 downloads of the datasets.…”

Automated Network Incident Identification through Genetic Algorithm-Driven Feature Selection

“…Over the past few years, Denial of Service (DoS), Operating System (OS) fingerprinting, and Domain Name System (DNS) botnet techniques have undergone significant advancements, becoming increasingly complex and challenging to identify [1][2][3][4][5][6][7][8]. While these activities may not always constitute an attack in the traditional sense, they encompass a spectrum of activities, including reconnaissance and denial of services.…”

Efficient Cyber Security Framework for IoT Using Machine Learning Algorithms

“…In this research, we offer a method for automatically generating the MUD profiles of IoT devices, which can subsequently be used to classify similar devices in the network and detect anomalies in their network traffic, such as those caused by compromised firmware or a hacker. The Software Defined Networking (SDN) architecture then takes this formal behavioural profile and translates it into static and dynamic flow rules that the network can enforce at runtime [5][6][7][8][9]. Traffic that follows these guidelines is permitted through, while all other traffic is screened for threats.…”