Automated Behavioral Fingerprinting

Abstract

The original publication is available at www.springerlink.comInternational audienceThis paper addresses the fingerprinting of devices that speak a common, yet unknown to the fingerprinting engine, protocol. We consider a behavioral approach, where the fingerprinting of an unknown protocol is based on detecting and exploiting differences in the observed behavior from two or more devices. Our approach assumes zero knowledge about the syntax and state machine underlying the protocol. The main contribution of this paper consists in a two phased method. The first phase identifies the different message types using an unsupervised support vector clustering algorithm. The second phase is leveraging recent advances in tree support kernel in order to learn and differentiate different implementations of that protocol. The key idea is to represent behavior in terms of trees and learn the distinctive subtrees that are specific to one particular device. Our solution is passive and does not assume active and stimulus triggered behavior templates. We instantiate our solution to the particular case of a VoIP specific protocol (SIP) and validate it using extensive data sets collected on a large size VoIP testbed

Network application profiling with traffic causality graphs

“…We use the same environment and one version for each application both for learning of the feature vectors and for identification. However, different versions of application, underlying environments or topologies possibly result in different flow patterns, as mentioned in device‐fingerprinting works . The impact on the profiling induced by these differences is to be evaluated.…”

Behavioral Fingerprinting of IoT Devices

“…General device fingerprinting has been described in [6], [7], [8], which have explored several techniques ranging from packet header features to physical features such as clockskews. Wireless device finger printing techniques have been discussed in [9], [10], [11], [12], [13]. These works explored the device type identification by exploring the implementation differences of a common protocol such as SIP, across similar devices.…”

Tracking spoofed locations in crowdsourced vehicular applications

“…Thus, an attacker can inject such erroneous data, as shown in Figure 1, using multiple vehicle identities (sybil attack) using a standard computer which is be considered as the most realistic and threatening scenario [12]. Complementary approaches to automatically identify such unusual or unauthorized devices also exist (device fingerprinting) but are dependent on the specific protocol used [13], [14]. Even without a success rate of 100%, an attacker may cause unforeseen and catastrophic consequences to location based services (creating traffic congestion and so indirectly rerouting people to specific locations, indicating false collisions which may provoke unnecessary braking, etc).…”