Hershel: Single-Packet OS Fingerprinting Academic Article

abstract

• 2015 IEEE. Traditional TCP/IP fingerprinting tools (e.g., nmap) are poorly suited for Internet-wide use due to the large amount of traffic and intrusive nature of the probes. This can be overcome by approaches that rely on a single SYN packet to elicit a vector of features from the remote server. However, these methods face difficult classification problems due to the high volatility of the features and severely limited amounts of information contained therein. Since these techniques have not been studied before, we first pioneer stochastic theory of single-packet OS fingerprinting, build a database of 116 OSs, design a classifier based on our models, evaluate its accuracy in simulations, and then perform OS classification of 37.8M hosts from an Internet-wide scan.

authors

• Loguinov, Dmitri

published proceedings

• IEEE-ACM TRANSACTIONS ON NETWORKING

author list (cited authors)

• Shamsi, Z., Nandwani, A., Leonard, D., & Loguinov, D.

citation count

• 14

complete list of authors

• Shamsi, Zain||Nandwani, Ankur||Leonard, Derek||Loguinov, Dmitri

publication date

• August 2016

publisher

• Institute of Electrical and Electronics Engineers (IEEE)  Publisher

published in

• IEEE ACM Transactions on Networking  Journal

keywords

• Internet Measurement
• Os Fingerprinting

Digital Object Identifier (DOI)

• 10.1109/TNET.2015.2447492

start page

• 2196

end page

• 2209

volume

• 24

issue

• 4

URL

• http%3A%2F%2Fdx.doi.org%2F10.1109%2Ftnet.2015.2447492