A Robust Classifier for Passive TCP/IP Fingerprinting

Measuring the state of ECN readiness in servers, clients,and routers

“…Table 2 shows that fewer clients negotiated ECN on incoming connections; 4.2% to less than 0.1% depending on population. To better understand this discrepancy, we employ stack fingerprinting to the TCP SYN/ACK packets [5] to infer the operating system of the client. Table 3 shows a striking difference between the ECN capable and non-ECN capable populations: the vast majority of ECN capable hosts are Linux (88.4%).…”

Browser Fingerprinting from Coarse Traffic Summaries: Techniques and Implications

“…More relevant to our work are passive fingerprinting techniques that infer the implementations of network applications or operating systems based solely on observing the traffic they send. Passive fingerprinting tools and techniques are numerous, though most focus on identifying TCP/IP implementations and utilize specific information [4,5,6] that is unavailable in coarse flow records. While passive techniques have more recently been proposed to identify the application (e.g., peer-to-peer file transfers versus web retrievals) or the class of application (e.g., interactive sessions versus bulk-data transfers) reflected in packet traces [7,8,9,10,11], few proposals (e.g., [12,13,14,15]) have done so from coarse flow records.…”

“…More specifically, the classifier type that we utilize is Support Vector Machines (SVM) 6 , which have been widely applied to many supervised learning problems [27,28]. Given two sets of labeled data, the SVM finds a hyperplane that separates the data and maximizes the distance to each data set.…”

Intrusion detection in networked control systems : from system knowledge to network security

“…Bayesian networks, neural networks, etc.). In [130], Beverly et al leverage probabilistic learning for TCP/IP stack fingerprinting and develop a Naïve Bayesian classifier to passively infer host operating systems from packet headers. The approach relies on observations made over TTL Window SYN packet sizes, and "do not fragment" bits as well as the use of Bayesian matching.…”

“…For this reason, over the training phase, a user links the model (also, "Decision Model") derived by the captured data to a textual description of the system it belongs to. However, sophisticated fingerprinting tools are able to automatically refine their datasets (e.g., thanks to machine learning techniques [124,130]). Finally, Model Generation ensures that every model is consistent and unambiguous and avoids overlaps in the dataset.…”