Operating System Classification Performance of TCP/IP Protocol Headers
Ahmet Aksoy, Mehmet Hadi Güneş · 2016
Identification of operating systems in a local network is an issue for both network management and security. Network practitioners rely on some classifier tools, but those tools' rules are generated by an expert. Hence, existing approaches need to be manually updated for each new operating system. In this paper, we analyze the TCP/IP packet headers to automate operating system classification. To this end, we measure the classification performance of each protocol, and determine the unique features between operating systems. We utilize a genetic algorithm to determine the relevant packet header features. Then, we use several machine learning algorithms to generate set of rules that can differentiate operating systems. Overall, with IP, ICMP, TCP, UDP, HTTP, DNS, SSL, SSH, and FTP, protocol header information, on average, operating system classification can be performed at a rate of 68.0%, 51.6%, 98.4%, 71.1%, 78.7%, 29.2%, 25.0%, 22.5%, and 14.0%, respectively. In general, feature extraction with genetic algorithm further improves the results, e.g. to an average of 99.1% for TCP.