Fingerprinting Network Device Based on Traffic Analysis in High-Speed Network Environment
Yiting Zhang, Ming Zhu Yang, Xiaodan Gu, Peilong Pan, Zhen Ling · 2018
The identification of network device is of vital importance to strengthen network identity management and maintain cyberspace security. However, traditional device identification technologies based on the MAC address, IP address or other explicit identifiers can be deactivated if the identifier is hidden or tampered. Meanwhile, the existing device fingerprinting technology is also restricted by its limited performance and excessive time lapse. In order to realize device identification in high-speed network environment, PFQ kernel module and Storm are used for high-speed packet capture and online traffic analysis, respectively. On this basis, a novel device fingerprinting technology based on runtime environment analysis is proposed, which employs logistic regression to implement online identification with a sliding window mechanism, reaching a recognition accuracy of 77.03% over a 60-minute period. Moreover, performance test results show that the proposed technology can support over 10Gbps traffic capture and online analysis, and the system architecture is justified in practice because of its practicability and extensibility.