TY - GEN
T1 - Operating system fingerprinting via automated network traffic analysis
AU - Aksoy, Ahmet
AU - Louis, Sushil
AU - Gunes, Mehmet Hadi
N1 - Publisher Copyright:
© 2017 IEEE.
PY - 2017/7/5
Y1 - 2017/7/5
N2 - Operating System (OS) detection significantly impacts network management and security. Current OS classification systems used by administrators use human-expert generated network signatures for classification. In this study, we investigate an automated approach for classifying host OS by analyzing the network packets generated by them without relying on human experts. While earlier approaches look for certain packets such as SYN packets, our approach is able to use any TCP/IP packet to determine the host systems' OS. We use genetic algorithms for feature subset selection in three machine learning algorithms (i.e., OneR, Random Forest and Decision Trees) to classify host OS by analyzing network packets. With the help of feature subset selection and machine learning, we can automatically detect the difference in network behaviors of OSs and also adapt to new OSs. Results show that the genetic algorithm significantly reduces the number of packet features to be analyzed while increasing the classification performance.
AB - Operating System (OS) detection significantly impacts network management and security. Current OS classification systems used by administrators use human-expert generated network signatures for classification. In this study, we investigate an automated approach for classifying host OS by analyzing the network packets generated by them without relying on human experts. While earlier approaches look for certain packets such as SYN packets, our approach is able to use any TCP/IP packet to determine the host systems' OS. We use genetic algorithms for feature subset selection in three machine learning algorithms (i.e., OneR, Random Forest and Decision Trees) to classify host OS by analyzing network packets. With the help of feature subset selection and machine learning, we can automatically detect the difference in network behaviors of OSs and also adapt to new OSs. Results show that the genetic algorithm significantly reduces the number of packet features to be analyzed while increasing the classification performance.
KW - Genetic algorithm
KW - Machine learning
KW - OS classification
UR - http://www.scopus.com/inward/record.url?scp=85027886496&partnerID=8YFLogxK
UR - http://www.scopus.com/inward/citedby.url?scp=85027886496&partnerID=8YFLogxK
U2 - 10.1109/CEC.2017.7969609
DO - 10.1109/CEC.2017.7969609
M3 - Conference contribution
AN - SCOPUS:85027886496
T3 - 2017 IEEE Congress on Evolutionary Computation, CEC 2017 - Proceedings
SP - 2502
EP - 2509
BT - 2017 IEEE Congress on Evolutionary Computation, CEC 2017 - Proceedings
T2 - 2017 IEEE Congress on Evolutionary Computation, CEC 2017
Y2 - 5 June 2017 through 8 June 2017
ER -