Fingerprinting IP-Connected Devices Using Machine Learning and Deep Learning Models

Abstract

Device fingerprinting enables various asset management scenarios. This work presents a comprehensive evaluation of machine learning (ML) and deep learning (DL) approaches for fingerprinting IP-connected devices using the publicly available network mapper (Nmap) operating system (OS) database. Focusing on the classification of three critical device characteristics, i.e., operating system family, vendor, and device type, fingerprinting is treated as a multiclass classification problem. The performance of eleven algorithms, including six classical ML models and five deep neural network (DNN) architectures, is evaluated. The experiments explore the impact of data imbalance, employing synthetic minority oversampling technique and adaptive synthetic for synthetic data augmentation. The empirical results show that tree-based ML models, such as decision trees, random forests, and extreme gradient boosting, achieve high accuracy at significantly lower training and inference costs than DNNs. Although DNNs can also yield competitive area under the curve (AUC) scores, their performance benefits are outweighed by training requirements, making them less suitable for most practical applications. This study concludes that traditional ML approaches remain preferable for OS, vendor, and device type classification in IP-connected device fingerprinting scenarios, and it highlights key tradeoffs in performance, complexity, and computational overhead. The results are of interest to industry stakeholders, including researchers, security practitioners, and system designers who integrate device identification into their asset management, security, and critical infrastructure systems.