Computer Science ›› 2016, Vol. 43 ›› Issue (8): 79-83.doi: 10.11896/j.issn.1002-137X.2016.08.016

Previous Articles     Next Articles

Research of Passive OS Recognition Based on Decision Tree

YI Yun-hui, LIU Hai-feng and ZHU Zhen-xian   

  • Online:2018-12-01 Published:2018-12-01

Abstract: As the problem of network treat is getting worse,it makes great sense to study the method of operation system recognition,which is a key part of network security evaluation.Current operation system recognition based on TCP/IP stack fingerprint database can not recognize unknown fingerprints.A passive operating system identification method based on decision tree was proposed,and it was compared with other classification algorithms.Experiment shows that this classification algorithm owns a better effectiveness and gives the explanation about the result.

Key words: OS recognition,TCP/IP stack,Fingerprinting,Decision tree,Effectiveness

[1] Schwartzenberg.Using Machine Learning Techniques for Ad-vanced Passive Operating System Fingerprinting[D].Ensch- chede:University of Twente,2010
[2] Jiao Jian.A method of identify OS based on TCP/IP fingerprint [J].International Journal of Computer Science and Network Security,2006,6(7B):77-82
[3] Fyodor.Remote OS Detection Via TCP/IP Stack Fingerprinting[EB/OL].(2014-06-23)[2014-08-21].http://insecure.org/nmap/nmap-fingerprinting-article.txt
[4] Greenwald L G,Thomas T.Toward undetected operation system fingerprinting[J].Proceedings of the first conference on First USENIX Workshop on Offensive Technologies,2007,20(8):6-7
[5] Arkin O.A remote active OS fingerprinting tool using ICMP[J].USENIX&SAGE,2002,27(2):14-19
[6] Medeiros J,Brito A,Pires P.An Effective TCP/IP Fingerprin-ting Technique Based on Strange Attractors Classification[C]∥Proc.DPM/SETOP.2009:208-221
[7] Shamsi Z,Nandwani A,Leonard D.Hershel:Single-Packet OSFingerprinting[C]∥The ACM SIGMETRICS Conference 2014.Austin Texas,ACM Press,2014:1-12
[8] Liu Y,Xue Z,Wang Y J.Remete OS Indentification Based on TCP Options[J].China Information Security,2007(11):71-72(in Chinese) 刘英,薛质,王轶骏.基于TCP协议可选项的远程操作系统识别[J].信息安全与通信保密,2007(11):71-72
[9] Beverly R.A Robust Classifier for Passive TCP/IP Fingerprinting[C]∥Proceedings of the 5th Passive and Active Measurement (PAM) Workshop.Boston USA,Springer,2004:158-167
[10] Sarraute C,Burroni J.Using Neural Networks to Improve Classical Operation System Fingerprinting Techniques[J].Electronic Journal of SADIO,2008,8(1):35-47
[11] Zhou Tie-zheng,Li Yuan,Zhang Bo-feng,et al.Operation system recognition based on support vector machines[J].Journal of Tsinghua University(Science and Technology),2009,49(S2):2164-2168(in Chinese) 邹铁铮,李渊,张博峰,等.基于支持向量机的操作系统识别方法[J].清华大学学报(自然科学版),2009,49(S2):2164-2168
[12] Cheng Shu-bao,Hu Yong.Operating System Recognition based on Singular Value Decomposition and DAG_SVMS[J].China Information Security,2013(9):66-67(in Chinese) 程书宝,胡勇.基于奇异值分解和DAG_SVMS的操作系统类型识别[J].信息安全与通信保密,2013(9):66-67
[13] Shu G,Lee D.A formal methodology for network protocolfjngerprinting[J].IEEE Transactions on Parallel and Distributed Systems,2011,22(11):1813-1825
[14] Kohno T,Broido A,Claffy K C.Remote physical device fingerprinting[J].IEEE Transactions on Dependable and Secure Computing,2005,2(2):93-108
[15] Tom M.Mitchell.Machine Learning[M].增华军,张银奎,译.北京:机械工业出版社,2013
[16] Liu San-ming,Sun Zhi-xin,Liu Yu-xia.Research of P2P Traffic Identification Based on Decision Tree Ensemble[J].Computer Science,2011,8(12):26-29(in Chinese) 刘三民,孙知信,刘余霞.基于决策树集成的P2P流量识别研究[J].计算机科学,2011,38(12):26-29

No related articles found!
Viewed
Full text


Abstract

Cited

  Shared   
  Discussed   
No Suggested Reading articles found!