Passive Operating System Fingerprinting Revisited: Evaluation and Current Challenges

Investor logo

Warning

This publication doesn't include Faculty of Sports Studies. It includes Institute of Computer Science. Official publication website can be found on muni.cz.
Authors

LAŠTOVIČKA Martin HUSÁK Martin VELAN Petr JIRSÍK Tomáš ČELEDA Pavel

Year of publication 2023
Type Article in Periodical
Magazine / Source Computer Networks
MU Faculty or unit

Institute of Computer Science

Citation
Web Published version on Elsevier ScienceDirect
Doi http://dx.doi.org/10.1016/j.comnet.2023.109782
Keywords OS fingerprinting; network monitoring; network management; cybersecurity; machine learning; survey
Attached files
Description Fingerprinting a host's operating system is a very common yet precarious task in network, asset, and vulnerability management. Estimating the operating system via network traffic analysis may leverage TCP/IP header parameters or complex analysis of hosts' behavior using machine learning. However, the existing approaches are becoming obsolete as network traffic evolves which makes the problem still open. This paper discusses various approaches to passive OS fingerprinting and their evolution in the past twenty years. We illustrate their usage, compare their results in an experiment, and list challenges faced by the current fingerprinting approaches. The hosts' differences in network stack settings were initially the most important information source for OS fingerprinting, which is now complemented by hosts' behavioral analysis and combined approaches backed by machine learning. The most impactful reasons for this evolution were the Internet-wide network traffic encryption and the general adoption of privacy-preserving concepts in application protocols. Other changes, such as the increasing proliferation of web applications on handheld devices, raised the need to identify these devices in the networks, for which we may use the techniques of OS fingerprinting.
Related projects:

You are running an old browser version. We recommend updating your browser to its latest version.

More info