arXiv preprint ·
Machine Learning Optimization for Enhanced OS Fingerprinting
- Published
- Source
- arXiv preprint, posted before peer review
- Published in
- arXiv
- DOI
- 10.48550/arxiv.2610.11133
- Original
- Read it at arXiv
- Cited by
- 0 works, as OpenAlex counts them
- Topics
In brief
Teaching Packet Captures to Name Their OS
The paper introduces OsirisML, a command-line tool that transforms packet captures into tabular features with nPrint and trains XGBoost models. On CIC-IDS2017 captures, it reports accuracy as high as 97.66% on a down-sampled Friday subset, with lower results on entire captures and a Monday capture containing no attacks.
What they found: OsirisML reached 97.66% accuracy on a down-sampled subset of the Friday CIC-IDS2017 capture, but achieved 84.69% on the full Friday capture. On the entire Monday capture, which contains no attacks, it reported 73.83% accuracy and a 79.38% F-1 score. These results show that passive OS classification is promising in this setup, but performance varies across captures and sampling choices.
AI-written summary. Check anything you rely on against the original paper.
Abstract
Operating System (OS) Fingerprinting is a technique that can be used to identify a network's operating systems by evaluating network traffic in the form of TCP/IP packets. This research will explore the effectiveness of passively identifying operating systems on the CIC-IDS2017 dataset, a collection of over 47 gigabytes of pcap files with their corresponding operating systems. This research also proposes a new command line interface, OsirisML, which uses nPrint to preprocess the data into tabular data and XGBoost to apply ML to the data to generate, retrain, and test ML models. When packets are split randomly between training and testing, OsirisML models reach an accuracy of 97.66% on a down-sampled subset of the Friday capture and 84.69% on the entire capture. On the entire Monday capture, which contains no attacks, OsirisML reaches an accuracy of 73.83% and an F-1 score of 79.38%.
The authors’ abstract, as arXiv lists it. arXiv’s listings, abstracts included, are free for anyone to reuse.
Read it on ReadSearch
Each opens after you create an account, and brings you back to this paper.
More in Machine Learning
Mid-Training Language Models on Raw Video
Inverse Synthesis of Shock Time Series from Shock Response Spectra Using Ensembles of Conditional Variational Autoencoders
A Graph Neural Network for Global Daily Fire Radiative Power Prediction at Medium-Range Lead Times
TreeHCA: Hindsight-Guided Exploration and Credit Assignment for Multi-Turn LLM Agents
NOMOS: Compiling Written Policies into Statically Verified Tool-Call Gates for LLM Agents
Get the few papers worth your time in Machine Learning every morning.
ReadSearch reads the new papers in your field each day and brings you the few worth reading, each with its key finding in a sentence.