Advanced Network Fingerprinting

Abstract

Security assessment tasks and intrusion detection systems do rely on automated fingerprinting of devices and services. Most current fingerprinting approaches use a signature matching scheme, where a set of signatures are compared with traffic issued by an unknown entity. The entity is identified by finding the closest match with the stored signatures. These fingerprinting signatures are found mostly manually, requiring a laborious activity and needing advanced domain specific expertise. In this paper we describe a novel approach to automate this process and build flexible and efficient fingerprinting systems able to identify the source entity of messages in the network. We follow a passive approach without need to interact with the tested device. Application level traffic is captured passively and inherent structural features are used for the classification process. We describe and assess a new technique for the automated extraction of protocol fingerprints based on arborescent features extracted from the underlying grammar. We have successfully applied our technique to the Session Initiation Protocol (SIP) used in Voice over IP signalling.

HTTPS traffic analysis and client identification using passive SSL/TLS fingerprinting

“…Graphbased structures for client profiling were introduced by Karagiannis et al [25]. Manual labeling of fingerprints, a drawback of fingerprint-based methods, was tackled by Abdelnur et al [26]. The authors intended to solve the problem by an automation of fingerprint signature creation.…”

VoIP Malware: Attack Tool & Attack Scenarios

“…This process can be fooled if the manufacturer string was intentionally falsified. Smarter fingerprinting schemes as described in [10] or in [11] can be supported as well. In a fingerprinting scenario, the bot is asked to fingerprint one or range of SIP extensions.…”

Semi-supervised Fingerprinting of Protocol Messages

“…Furthermore, such techniques are only able to identify devices for which signatures were manually constructed and keeping a signature database up-to-date is difficult to the huge variety and upgrade of devices. A related work is presented in [4] which needs a grid of 10 computers during several days for an equivalent dataset as the testbed dataset. We have used the constructs introduced in our previous works [10,11] and argued to use a semi supervised learning which uses a small quantity of labeled data.…”