“…Mossel's work [21] using destination address was already introduced. Matsunaka et al [48], Chang et al [49], and Voronov et al [50] take the OS-specific queries from DNS requests, Laštovička et al [27,45] use HTTP hostname and TLS Server Name Indication (SNI) fields. In all cases, they build a database of known OS and their related service locations identified either by IP address or a domain name.…”