Martin Laštovička, Tomás Jirsík, Pavel Čeleda, Stanislav Špaček, Daniel Filakovsky
{"title":"Passive os fingerprinting methods in the jungle of wireless networks","authors":"Martin Laštovička, Tomás Jirsík, Pavel Čeleda, Stanislav Špaček, Daniel Filakovsky","doi":"10.1109/NOMS.2018.8406262","DOIUrl":null,"url":null,"abstract":"Operating system fingerprinting methods are well- known in the domain of static networks and managed environments. Yet few studies tackled this challenge in real networks, where users can bring and connect any device. We evaluate the performance of three OS fingerprinting methods on a large dataset collected from university wireless network. Our results show that method based on HTTP User-agents is the most accurate but can identify only low portion of the traffic. TCP/IP parameters method proved to be the opposite with high coverage but low accuracy. We also implemented a new method based on detection of communication to OS-specific domains. Its performance is comparable to the two established ones. Next, we discuss the impacts of traffic encryption and embracing new protocols such as IPv6 or HTTP/2.0 on OS fingerprinting. Our findings suggest that OS identification based on specific domain detection is viable and corresponds to the current directions of network traffic evolution, while methods based on TCP/IP parameters and User-agents will become ineffective in the future.","PeriodicalId":19331,"journal":{"name":"NOMS 2018 - 2018 IEEE/IFIP Network Operations and Management Symposium","volume":null,"pages":null},"PeriodicalIF":0.0000,"publicationDate":"2018-04-23","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":"25","resultStr":null,"platform":"Semanticscholar","paperid":null,"PeriodicalName":"NOMS 2018 - 2018 IEEE/IFIP Network Operations and Management Symposium","FirstCategoryId":"1085","ListUrlMain":"https://doi.org/10.1109/NOMS.2018.8406262","RegionNum":0,"RegionCategory":null,"ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":null,"EPubDate":"","PubModel":"","JCR":"","JCRName":"","Score":null,"Total":0}
引用次数: 25
Abstract
Operating system fingerprinting methods are well- known in the domain of static networks and managed environments. Yet few studies tackled this challenge in real networks, where users can bring and connect any device. We evaluate the performance of three OS fingerprinting methods on a large dataset collected from university wireless network. Our results show that method based on HTTP User-agents is the most accurate but can identify only low portion of the traffic. TCP/IP parameters method proved to be the opposite with high coverage but low accuracy. We also implemented a new method based on detection of communication to OS-specific domains. Its performance is comparable to the two established ones. Next, we discuss the impacts of traffic encryption and embracing new protocols such as IPv6 or HTTP/2.0 on OS fingerprinting. Our findings suggest that OS identification based on specific domain detection is viable and corresponds to the current directions of network traffic evolution, while methods based on TCP/IP parameters and User-agents will become ineffective in the future.
操作系统指纹识别方法在静态网络和管理环境领域是众所周知的。然而,很少有研究在用户可以携带和连接任何设备的真实网络中解决这一挑战。我们在从大学无线网络收集的大型数据集上评估了三种操作系统指纹识别方法的性能。我们的结果表明,基于HTTP user -agent的方法是最准确的,但只能识别一小部分流量。结果表明,TCP/IP参数法与之相反,覆盖率高,精度低。我们还实现了一种基于检测到os特定域的通信的新方法。其性能可与两款既有机型相媲美。接下来,我们将讨论流量加密和采用新协议(如IPv6或HTTP/2.0)对操作系统指纹的影响。我们的研究结果表明,基于特定域检测的操作系统识别是可行的,并且符合当前网络流量演变的方向,而基于TCP/IP参数和user -agent的方法将在未来变得无效。