TCP - IP White Papers
Passive Operating System Identification From TCP/IP Packet Headers
Overview Accurate operating system (OS) identification by passive network traffic analysis can continuously update less-frequent active network scans and help interpret alerts from intrusion detection systems. The most recent open-source passive OS identification tool (ettercap) rejects 70% of all packets and has a high 75-class error rate of 30% for non-rejected packets on unseen test data. New classifiers were developed using machine-learning approaches including cross-validation testing, grouping OS names into fewer classes, and evaluating alternate classifier types. Nearest neighbor and binary tree classifiers provide a low 9-class OS identification error rate of roughly 10% on unseen data without rejecting packets. This error rate drops to nearly zero when 10% of the packets are rejected.
| Publisher | Massachusetts Institute of Technology | File Format | |
|---|---|---|---|
| Date Published | July 2004 | Downloads | 3 |
| Format | White Papers | ||
| Topics | |||
-
Did you find this white paper useful? 2 out of 5 users found this white paper useful
White Paper RSS
Download
Register
