본문 바로가기
KERD
논문KCI 등재

기계 학습 활용 운영체제 핑거프린팅 연구 조사

A Survey on Machine Learning Based OS Fingerprinting

안명식|김휘강|윤경찬|박상범
한국정보보호학회 (Korea Institute Of Information Security And Cryptology)|2024.12|정보보호학회논문지 (Journal of The Korea Institute of Information Security and Cryptology)|제34권 제6호|pp. 1211-1229|DOI https://doi.org/10.13089/JKIISC.2024.34.6.1211

0

조회

0

다운로드

0

인용

0

참고문헌

키워드

Machine learningDeep learningOS FingerprintingNetwork Monitoring
주제분류컴퓨터학

초록

본 논문에서는 운영체제(OS) 식별에 관한 최신 연구 동향을 조사하였고, 그중 기계 학습 기술이 적용된 운영체제 핑거프린팅을 중점적으로 다루었다. 현대 정보보호 분야에서 자산관리 또는 취약점 진단을 수행하는 과정에서 운영체제 식별의 중요성은 더욱 강조되고 있다. 최근의 연구에서는 기계 학습을 활용하여 핑거프린팅의 한계를 극복하려는 시도가 두드러지고 있으며, 다양한 데이터와 알고리즘을 활용하여 운영체제를 효과적으로 분류하는 방법이 모색되고 있다. 본 논문은 기계 학습 기반의 운영체제 핑거프린팅에 관한 최신 연구 동향을 종합적으로 검토하고, 기존 방법의 한계를 극복하고자 하는 노력을 다룬다. 또한, 운영체제 식별 분야의 응용 가능성과 연구 방향을 제시한다.

Abstract

In this paper, we investigate the latest advancements in operating system (OS) identification, with a particular emphasis on fingerprinting techniques that leverage machine learning technology. Within the contemporary information security landscape, the importance of OS identification is becoming increasingly pronounced, particularly for tasks like asset management and vulnerability assessment. Recent research has witnessed significant efforts to address the limitations of fingerprinting through the integration of machine learning. Researches are actively exploring various data sources and algorithms to effectively distinguish between different operating systems. This paper provides a comprehensive review of the latest research trends in machine learning-based OS fingerprinting, focusing on how these approaches aim to overcome existing limitations of traditional methods. Additionally, the paper discusses the applicability of these techniques and explores potential future research directions within the field of OS identification.

참고문헌 (48)

  1. T.Kohno, "Remote physical device fingerprinting", IEEE Transactions on Dependable and Secure Computing, 2(2), pp.93~108 (2005)
  2. J.M.Allen, "OS and Application Fingerprinting Techniques", SANS Institute InfoSec Reading Room, ~ (2007)
  3. G.F.Lyon, "Nmap network scanning:the official Nmap project guide to network discovery and security scanning" (2009), Insecure
  4. "Xprobe v2. 0: A “Fuzzy” Approach to Remote Active Operating Systems Fingerprinting" (2023)[URL]
  6. Wei-Hua, "The application of ICMP protocol in network scanning", Proceedings of the Fourth International Conference on Parallel and Distributed Computing, Applications and Technologies (2003), IEEE
  7. Technical guide to information security testing and assessment, "Scarfone, Karen", NIST, 2~25, pp.NIST Special Publication 800.115 (2008)
  8. "criminal ip asset search" (2023)[URL]
  9. Richard Lippmann, "Passive operating system identification from TCP", IP packet headers, 2003, pp.40, ~
  10. "p0f(v3.09b)" (2023)[URL]
  11. Beverly, Robert, "A robust classifier for passive TCP", IP fingerprinting, 2004, ~[DOI]
  12. Al-Shehari, Taher, "Improving operating system fingerprinting using machine learning techniques", International Journal of Computer Theory and Engineering, 57(6.1) (2014)
  13. Xinlei Fan, "Identify OS from encrypted traffic with TCP", IP stack fingerprinting, 2019 (2019), 1~7
  14. Hulák, Matej, "Evaluation of passive OS fingerprinting methods using TCP", IP fields, 2023 (2023), 1~4[DOI]
  15. Desta Haileselassie Hagos, "Advanced passive operating system fingerprinting using machine learning and deep learning", 2020 29th International Conference on Computer Communications and Networks (ICCCN), pp.1~11 (2020), IEEE
  16. Desta Haileselassie Hagos, "A machine-learning-based tool for passive os fingerprinting with tcp variant as a novel feature", IEEE Internet of Things Journal, 8(5), pp.3534~3553 (2021)
  17. Laštovička, Martin, "Machine learning fingerprinting methods in cyber security domain: Which one to use?", 2018 14th International Wireless Communications & Mobile Computing Conference (IWCMC), pp.542~547 (2018), IEEE
  18. Daowei Zhang, "An Operating system identification method based on active learning", 2022 International Conference on Electrical, Computer and Energy Technologies (ICECET), pp.1~6 (2022), IEEE
  19. Laštovička, Martin, "Network monitoring and enumerating vulnerabilities in large heterogeneous networks", NOMS 2020-2020 IEEE, 2020, 1~6[DOI]
  20. Voronov, Igor, "Determining OS and applications by DNS traffic analysis", 2021 IEEE Conference of Russian Young Researchers in Electrical and Electronic Engineering (ElConRus), pp.72~76 (2021), IEEE
  21. Yi-Chao Chen, "OS fingerprinting and tethering detection in mobile networks", Proceedings of the 2014 Conference on Internet Measurement Conference, pp.173~180 (2014)
  22. Chang, Deliang, "Study on os fingerprinting and nat", tethering based on dns log analysis, 2015, 1~4
  23. Aksoy, Ahmet, "Operating system classification performance of tcp", ip protocol headers, 2016 (2016), 112~120[DOI]
  24. Aksoy, Ahmet, "Operating system fingerprinting via automated network traffic analysis", 2017 IEEE Congress on Evolutionary Computation (CEC), pp.2502~2509 (2017), IEEE
  25. B. Anderson, "OS fingerprinting:New techniques and a study of information gain and obfuscation", 2017 IEEE Conference on Communications and Network Security (CNS), pp.1~9 (2017)
  26. Martin Lastovicka, "Passive os fingerprinting methods in the jungle of wireless networks", NOMS 2018-2018IEEE, 2018, 1~9[DOI]
  27. Martin Laštovička, "Using TLS fingerprints for OS identification in encrypted traffic", NOMS 2020-2020IEEE, 2020, 1~6[DOI]
  28. L. Rajala, "Generic Encrypted Traffic Identification using Network Grammar : A Case Study in Passive OS Fingerprinting", ~ (2022)
  29. J. Li, "Passive OS Identification in Imbalanced Dataset", 2023 International Conference on Electrical, Computer and Energy Technologies (ICECET), pp.1~6 (2023)
  30. Pérez-Jove, Rubén, "Operating System Fingerprinting Tool Based on Classical Machine Learning Algorithms", 2023 JNIC Cybersecurity Conference (JNIC), pp.61~8 (2023), IEEE
  31. H. D. Trinh, Á, "Mobile Traffic Classification Through Physical Control Channel Fingerprinting:A Deep Learning Approach", IEEE Transactions on Network and Service Management, 18(2), pp.1946~1961 (2021)
  32. L Kupershtein, "Remote host operation system type detection based on machine learning approach", Selected Papers of the II International Scientific Symposium"Intelligent Solutions, 3106(3106), pp.65~81 (2021)
  33. González, Florencio J, "Identification of Static and Dynamic Security Controls Using Machine Learning", Computación y Sistemas, 27(2), pp.581~592 (2023)
  34. JPS Medeiros, "Application of Kohonen Maps to Improve Security Tests on Automation Devices", Critical Information Infrastructures Security:Second International Workshop, CRITIS 2007, pp.235~245 (2007)
  35. JPS Medeiros, "An Effective TCP", IP Fingerprinting Technique Based on Strange Attractors Classification, 2009, 208~221[DOI]
  36. JPS Medeiros, "Using intelligent techniques to extend the applicability of operating system fingerprint databases", Journal of Information Assurance and Security, 5(1), pp.554~560 (2010)
  37. Kohonen, "The self-organizing map", Proceedings of the IEEE, 78(9), pp.1464~1480 (1990)
  38. Fifield, "OS fingerprint classification using a support vector machine", ~ (2010)
  39. Shamsi, Zain, "Faulds: A non-parametric iterative classifier for internet-wide os fingerprinting", IEEE, 2021, pp.29(5), 2339~2352
  40. H Fan, "A Random Forest-based Operating System Recognition Algorithm for Network Security", 2022 International Conference on Computer Engineering and Artificial Intelligence (ICCEAI), pp.539~550 (2022)
  41. W Yang, "Networked Industrial Control Device Asset Identification Method Based on Improved Decision Tree", Journal of Network and Systems Management, 32(32) (2024)
  42. Z Shamsi, "Hershel: single-packet os fingerprinting", ACM SIGMETRICS Performance Evaluation Review, 42(1), pp.195~206 (2014)
  43. Song, Jinho, "Analysis of operating system identification via fingerprinting and machine learning", Computers &Electrical Engineering, 78, pp.1~10 (2019)
  45. AK Suleiman, "A Passive OS-Fingerprinting framework using honeypot", 2022 ASU International Conference in Emerging Technologies for Sustainability and Intelligent Systems (ICETSIS), pp.178~185 (2022), IEEE
  46. X Zhong, "Research on automated cyber asset scanning tools based on cybersecurity knowledge graph", 2021 7th International Conference on Computer and Communications (ICCC), pp.2046~2049 (2021), IEEE
  47. S. Bai, "Passive OS Fingerprinting on Commodity Switches", 2022 IEEE 8th International Conference on Network Softwarization (NetSoft), pp.264~268 (2022)
  48. Pat Bosshart, "P4:Programming protocol-independent packet processors", ACM SIGCOMM Computer Communication Review, 44(3), pp.87~95 (2014)

관련 논문AI추천

운영 기술 환경에서 수동적 스캐닝 기반 장치 식별의 비교 분석김홍근, 박민수, 박세연, 안석현, 조성제한국소프트웨어감정평가학회 · 한국소프트웨어감정평가학회 논문지2023 · 제19권 제3호다크웹 범죄 서비스 분류를 위한 머신러닝 기반 애플리케이션 계층 네트워크 핑거프린팅 연구강동원, 김지연, 신진우한국컴퓨터정보학회 · 한국컴퓨터정보학회논문지2025 · 제30권 제12호선별된 특성 정보를 이용한 안드로이드 악성 앱 탐지 연구김강석, 명상준중소기업융합학회 · 융합정보논문지2022 · 제12권 제3호트래픽 데이터의 통계적 기반 특징과 앙상블 학습을 이용한 토르 네트워크 웹사이트 핑거프린팅김원겸, 김준호, 황두성한국정보처리학회 · 정보처리학회 논문지2020 · 제9권 제6호표준 웹 환경 디바이스 핑거프린트를 활용한 이용자 인증모델 연구박소희, 장진혁, 최대선한국정보보호학회 · 정보보호학회논문지2020 · 제30권 제4호정적 분석 기반 기계학습 기법을 활용한 악성코드 식별 시스템 연구김수정, 오수현, 이태진, 하지희한국정보보호학회 · 정보보호학회논문지2019 · 제29권 제4호

이 간행물의 다른 논문 (34건)

블록암호 MGFN의 선형 공격에 대한 안전성 분석전용진, 김남일, 백승준, 김종성pp. 1161-1170딥러닝을 활용한 경량 블록 암호의 신경망 구분자 성능 개선 기술 연구오채린, 임우상, 서창호, 김현일, 정수용pp. 1171-1188Width 효율적 ASCON 양자 회로를 이용한 Grover 기반 양자 보안비도 분석최찬호, 최두호, 오진섭pp. 1189-1199terSIDH의 성능 분석 및 상수 시간 구현김수리, 이정환, 홍석희, 허동회, 강태훈pp. 1201-1209웹셸 탐지를 위한 TF-IDF 및 응답 용량 변동 기반 사용자 행위 임베딩이인섭, 김강문pp. 1231-1238
원문 보기