Unsupervised Clustering Under Temporal Feature Volatility in Network Stack Fingerprinting
Conference Paper
Overview
Research
Identity
Additional Document Info
Other
View All
Overview
abstract
2016 ACM. Maintaining and updating signature databases is a tedious task that normally requires a large amount of user effort. The problem becomes harder when features can be distorted by observation noise, which we call volatility. To address this issue, we propose algorithms and models to automatically generate signatures in the presence of noise, with a focus on stack fingerprinting, which is a research area that aims to discover the operating system (OS) of remote hosts using TCP/IP packets. Armed with this framework, we construct a database with 420 network stacks, label the signatures, develop a robust classifier for this database, and fingerprint 66M visible webservers on the Internet.
name of conference
Proceedings of the 2016 ACM SIGMETRICS International Conference on Measurement and Modeling of Computer Science