Passive operating system fingerprinting using neural networks and induction of decision rules

One of the most difficult task for people managing big- or even medium-size computer network is determining the accurate number of hosts that are protected. This information is really helpful for accurately configuring network-based devices such as intrusion detection systems. Exact knowledge of the operating systems (residing in hosts) can be useful for excluding many alerts that cannot apply to a remote operating system that is being examined. In this context, we consider a classification problem (we try to recognize the class of operating system) when some of the characteristics of the system are modified by its user or any other program (e.g. for internet connection tuning). We use neural networks (MLP, RBF) and rule induction techniques. It should be stressed that existing fingerprinting tools get high accuracy results when tested on the “clean” versions of operating systems, but they fail to detect systems with modified TCP/IP parameters.