Passive os fingerprinting methods in the jungle of wireless networks

Laštovička, Martin; Jirsík, Tomáš; Čeleda, Pavel; Špaček, Stanislav; Filakovsky, Daniel

doi:10.1109/noms.2018.8406262

Cited by 30 publications

(44 citation statements)

References 20 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Even without a priori knowledge about device types, security operators could still isolate network traffic from mobile devices based on MAC addresses and orthogonal OS fingerprinting approaches: for example, related work has shown that DHCP messages [46], TCP/IP headers [18], and OS-specific destinations [36] (e.g., update servers and mobile app markets), can be used to identify mobile devices, and even tethering.…”

Section: Threat Modelmentioning

confidence: 99%

FlowPrint: Semi-Supervised Mobile-App Fingerprinting on Encrypted Network Traffic

Ede

Bortolameotti²,

Continella

et al. 2020

Proceedings 2020 Network and Distributed System Security Symposium

127

View full text Add to dashboard Cite

Mobile-application fingerprinting of network traffic is valuable for many security solutions as it provides insights into the apps active on a network. Unfortunately, existing techniques require prior knowledge of apps to be able to recognize them. However, mobile environments are constantly evolving, i.e., apps are regularly installed, updated, and uninstalled. Therefore, it is infeasible for existing fingerprinting approaches to cover all apps that may appear on a network. Moreover, most mobile traffic is encrypted, shows similarities with other apps, e.g., due to common libraries or the use of content delivery networks, and depends on user input, further complicating the fingerprinting process. As a solution, we propose FLOWPRINT, a semi-supervised approach for fingerprinting mobile apps from (encrypted) network traffic. We automatically find temporal correlations among destination-related features of network traffic and use these correlations to generate app fingerprints. Our approach is able to fingerprint previously unseen apps, something that existing techniques fail to achieve. We evaluate our approach for both Android and iOS in the setting of app recognition, where we achieve an accuracy of 89.2%, significantly outperforming stateof-the-art solutions. In addition, we show that our approach can detect previously unseen apps with a precision of 93.5%, detecting 72.3% of apps within the first five minutes of communication.

show abstract

Section: Threat Modelmentioning

confidence: 99%

FlowPrint: Semi-Supervised Mobile-App Fingerprinting on Encrypted Network Traffic

Ede

Bortolameotti²,

Continella

et al. 2020

Proceedings 2020 Network and Distributed System Security Symposium

127

View full text Add to dashboard Cite

show abstract

“…Upon receiving data, an operating system is determined for every active IP address in the network according to the methods introduced in our previous paper [1]. This IP address and OS are bound and stored in the graph database after every run of the analyser.…”

Section: B Data Processingmentioning

confidence: 99%

“…In our previous work, we have shown that OS fingerprinting methods are viable in the environment of wireless networks and will outlast adaptation of new network protocols [1]. However, modern networks are constantly changing and evolving environment which poses new challenges on any OS fingerprint system.…”

Section: Introductionmentioning

confidence: 99%

“…In this paper, we propose a system architecture to detect operating system of every actively communicating device in the network. We use the methods of passive OS fingerprinting presented in our previous work [1] which suit the continuous monitoring requirements. Our system solves the first challenge by maintaining timestamps for each observed fingerprint.…”

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

Passive os fingerprinting prototype demonstration

Laštovička

Filakovsky

2018

NOMS 2018 - 2018 IEEE/IFIP Network Operations and Management Symposium

Self Cite

View full text Add to dashboard Cite

Operating system identification of communicating devices plays an important part in network protection. However, current networks are large and change often which implies the need for a system that will be able to continuously monitor the network and handle changes in identified operating systems. In this paper, we propose an architecture of an OS fingerprinting system based on passive network monitoring and a graph-based data model to store and present information about operating systems in the network. We implemented the proposed architecture and tested it on the backbone network of Masaryk University. Our results suggest that it is suitable for monitoring a large network with tens of thousands of actively communicating devices.

show abstract

“…This approach enables monitoring of backbone networks, but the reduced visibility may pose a challenge for established OS fingerprinting methods as the required data might be unavailable. Matousek et al [3] adapted the OS fingerprinting to the notion of network flow technology and Lastovicka et al [4] showed the flow-based fingerprinting to be usable in large dynamic networks.…”

Section: Introductionmentioning

confidence: 99%

Machine Learning Fingerprinting Methods in Cyber Security Domain: Which one to Use?

Laštovička

Dufka

Komárková

2018

2018 14th International Wireless Communications &Amp; Mobile Computing Conference (IWCMC)

Self Cite

View full text Add to dashboard Cite

Identification of a communicating device operating system is a fundamental part of network situational awareness. However, current networks are large and change often which implies the need for a system that will be able to continuously monitor the network and handle changes in identified operating systems. The aim of this paper is to compare machine learning methods performance for OS fingerprinting on real-world data in the terms of processing time, memory requirements, and performance measures of accuracy, precision, and recall.

show abstract

Passive os fingerprinting methods in the jungle of wireless networks

Cited by 30 publications

References 20 publications

FlowPrint: Semi-Supervised Mobile-App Fingerprinting on Encrypted Network Traffic

FlowPrint: Semi-Supervised Mobile-App Fingerprinting on Encrypted Network Traffic

Passive os fingerprinting prototype demonstration

Machine Learning Fingerprinting Methods in Cyber Security Domain: Which one to Use?

Contact Info

Product

Resources

About