Unsupervised Clustering Under Temporal Feature Volatility in Network Stack Fingerprinting Conference Paper uri icon

abstract

  • 2016 ACM. Maintaining and updating signature databases is a tedious task that normally requires a large amount of user effort. The problem becomes harder when features can be distorted by observation noise, which we call volatility. To address this issue, we propose algorithms and models to automatically generate signatures in the presence of noise, with a focus on stack fingerprinting, which is a research area that aims to discover the operating system (OS) of remote hosts using TCP/IP packets. Armed with this framework, we construct a database with 420 network stacks, label the signatures, develop a robust classifier for this database, and fingerprint 66M visible webservers on the Internet.

name of conference

  • Proceedings of the 2016 ACM SIGMETRICS International Conference on Measurement and Modeling of Computer Science

published proceedings

  • SIGMETRICS/PERFORMANCE 2016: PROCEEDINGS OF THE SIGMETRICS/PERFORMANCE JOINT INTERNATIONAL CONFERENCE ON MEASUREMENT AND MODELING OF COMPUTER SCIENCE

author list (cited authors)

  • Shamsi, Z., & Loguinov, D.

citation count

  • 3

complete list of authors

  • Shamsi, Zain||Loguinov, Dmitri

editor list (cited editors)

  • Alouf, S., Jean-Marie, A., Hegde, N., & Proutière, A.

publication date

  • June 2016