Publication Details

Towards Identification of Operating Systems from the Internet Traffic. IPFIX Monitoring with Fingerprinting and Clustering

MATOUŠEK Petr, RYŠAVÝ Ondřej, GRÉGR Matěj and VYMLÁTIL Martin. Towards Identification of Operating Systems from the Internet Traffic. IPFIX Monitoring with Fingerprinting and Clustering. In: DCNET2014. Proceedings of the 5th International Conference on Data Communication Networking. Wien: SciTePress - Science and Technology Publications, 2014, pp. 21-27. ISBN 978-989-758-042-0.
Czech title
Identifikace operačního systému z internetového provozu. Monitorování pomocí metody fingerprinting a shlukování.
Type
conference paper
Language
english
Authors
Matoušek Petr, doc. Ing., Ph.D., M.A. (DIFS FIT BUT)
Ryšavý Ondřej, doc. Ing., Ph.D. (DIFS FIT BUT)
Grégr Matěj, Ing., Ph.D. (DIFS FIT BUT)
Vymlátil Martin, Ing. (FIT BUT)
Keywords

Operating Systems, Identification, Fingerprinting, Clustering, Monitoring, IPFIX

Abstract

This paper deals with identification of operating systems (OSs) from the Internet traffic. Every packet injected on the network carries a specific information in its packet header that reflects the initial settings of a host's operating system. The set of such features forms a fingerprint. The OS fingerprint usually includes an initial TTL time, a TCP initial window time, a set of specific TCP options, and other values obtained from IP and TCP headers. Identification of OSs can be useful for monitoring a traffic
  on a local network  and also for security purposes. In our paper we  focus on the passive fingerprinting using TCP SYN packets that is   incorporated to a IPFIX probe. Our tool enhances standard IPFIX records by additional information about OSs. Then, it sends the records to an IPFIX collector where network statistics are stored and presented to the network administrator. If identification is not successful, a further HTTP header check is employed and the fingerprinting database in the probe is updated. Our fingerprinting technique can be extended using cluster analysis as presented in this paper. As we show the clustering adds flexibility and dynamics to the fingerprinting. We also discuss the impact of IPv6 protocol on the passive fingerprinting.  

Published
2014
Pages
21-27
Proceedings
DCNET2014. Proceedings of the 5th International Conference on Data Communication Networking
Conference
Data Communication Networking, Wien, AT
ISBN
978-989-758-042-0
Publisher
SciTePress - Science and Technology Publications
Place
Wien, AT
DOI
10.5220/0005099500210027
EID Scopus
2-s2.0-84908876572
BibTeX 
@INPROCEEDINGS{FITPUB10642,
   author = "Petr Matou\v{s}ek and Ond\v{r}ej Ry\v{s}av\'{y} and Mat\v{e}j Gr\'{e}gr and Martin Vyml\'{a}til",
   title = "Towards Identification of Operating Systems from the Internet Traffic. IPFIX Monitoring with Fingerprinting and Clustering",
   pages = "21--27",
   booktitle = "DCNET2014. Proceedings of the 5th International Conference on Data Communication Networking",
   year = 2014,
   location = "Wien, AT",
   publisher = "SciTePress - Science and Technology Publications",
   ISBN = "978-989-758-042-0",
   doi = "10.5220/0005099500210027",
   language = "english",
   url = "https://www.fit.vut.cz/research/publication/10642"
}
Files
Back to top