Operating System Classification Performance of TCP/IP Protocol Headers

Ahmet Aksoy, Mehmet Hadi Gunes

    Research output: Chapter in Book/Report/Conference proceedingConference contributionpeer-review

    14 Scopus citations

    Abstract

    Identification of operating systems in a local network is an issue for both network management and security. Network practitioners rely on some classifier tools, but those tools' rules are generated by an expert. Hence, existing approaches need to be manually updated for each new operating system. In this paper, we analyze the TCP/IP packet headers to automate operating system classification. To this end, we measure the classification performance of each protocol, and determine the unique features between operating systems. We utilize a genetic algorithm to determine the relevant packet header features. Then, we use several machine learning algorithms to generate set of rules that can differentiate operating systems. Overall, with IP, ICMP, TCP, UDP, HTTP, DNS, SSL, SSH, and FTP, protocol header information, on average, operating system classification can be performed at a rate of 68.0%, 51.6%, 98.4%, 71.1%, 78.7%, 29.2%, 25.0%, 22.5%, and 14.0%, respectively. In general, feature extraction with genetic algorithm further improves the results, e.g. to an average of 99.1% for TCP.

    Original languageEnglish
    Title of host publicationProceedings - 2016 IEEE 41st Conference on Local Computer Networks Workshops, LCN Workshops 2016
    Pages112-120
    Number of pages9
    ISBN (Electronic)9781509023479
    DOIs
    StatePublished - 2 Jul 2016
    Event41st IEEE Conference on Local Computer Networks Workshops, LCN Workshops 2016 - Dubai, United Arab Emirates
    Duration: 7 Nov 201610 Nov 2016

    Publication series

    NameProceedings - Conference on Local Computer Networks, LCN

    Conference

    Conference41st IEEE Conference on Local Computer Networks Workshops, LCN Workshops 2016
    Country/TerritoryUnited Arab Emirates
    CityDubai
    Period7/11/1610/11/16

    Keywords

    • Genetic Algorithm
    • Machine Learning
    • OS Fingerprinting

    Fingerprint

    Dive into the research topics of 'Operating System Classification Performance of TCP/IP Protocol Headers'. Together they form a unique fingerprint.

    Cite this