Abstract
We propose a new technique to perform TCP/IP (Transmission Control Protocol/Internet Protocol) stack fingerprinting. Our technique relies on chaotic dynamics theory and artificial neural networks applied to TCP ISN (Initial Sequence Number) samples making possible to associate strange attractors to operating systems. We show that it is possible to recognize operating systems using only an open TCP port on the target machine. Also, we present results which shows that our technique cannot be fooled by Honeyd or affected by PAT (Port Address Translation) environments.
This is a preview of subscription content, log in via an institution to check access.
Access this chapter
Tax calculation will be finalised at checkout
Purchases are for personal use only
Preview
Unable to display preview. Download preview PDF.
References
Medeiros, J.P.S., Brito Jr., A.M., Pires, P.S.M.: A Data Mining Based Analysis of Nmap Operating System Fingerprint Database. In: Proceedings of the 2nd International Workshop on Computational Intelligence in Security for Information Systems (CISIS 2009). Advances in Intelligent and Soft Computing, vol. 63 (to be published, 2009)
Fyodor: Nmap (2009), http://www.nmap.org/
Provos, N.: Honeyd (2008), http://www.honeyd.org/
Provos, N., Holz, T.: Virtual Honeypots: From Botnet Tracking to Intrusion Detection. Addison-Wesley, Reading (2008)
Auffret, P.: SinFP (2008), http://www.gomor.org/bin/view/Sinfp
Zalewski, M.: Strange attractors and TCP/IP sequence number analysis (2001), http://lcamtuf.coredump.cx/oldtcp/tcpseq.html
Veysset, F., Courtay, O., Heen, O., et al.: New tool and technique for remote operating system fingerprinting. Intranode Software Technologies (2002)
Baker, G.L., Gollub, J.P.: Chaotic Dynamics: An Introduction, 2nd edn. Cambridge University Press, Cambridge (1996)
Ott, E.: Chaos in Dynamical Systems, 2nd edn. Cambridge University Press, Cambridge (2002)
Alligood, K., Sauer, T., Yorke, J.: Chaos: an introduction to dynamical systems. Springer, Heidelberg (1997)
Kohonen, T.: Self-Organizing Maps, 3rd edn. Springer, Heidelberg (2001)
Postel, J.: RFC 793: Transmission control protocol. Technical report (1996)
Bellovin, S.: RFC 1948: Defending Against Sequence Number Attacks. Technical report (1996)
CERT: CERT advisory CA-2001-09 statistical weaknesses in TCP/IP initial sequence numbers (2001), http://www.cert.org/advisories/CA-2001-09.html
OpenBSD: PF: The OpenBSD Packet Filter (2008), http://www.openbsd.org/faq/pf/
Medeiros, J.P.S., Brito Jr., A.M., Pires, P.S.M.: A new method for recognizing operating systems of automation devices. In: Proc. IEEE Conference on Emerging Technologies and Factory Automation, ETFA 2009 (to be published, 2009)
Goerke, N., Kintzler, F., Eckmiller, R.: Self organized classification of chaotic domains from a nonlinear attractor. In: Proc. International Joint Conference on Neural Networks (IJCNN 2001), Washington, DC, July 2001, vol. 3 (2001)
Medeiros, J.P.S., Cunha, A.C., Brito Jr., A.M., Pires, P.S.M.: Application of Kohonen maps to improve security tests on automation devices. In: Lopez, J., Hämmerli, B.M. (eds.) CRITIS 2007. LNCS, vol. 5141, Springer, Heidelberg (2008)
Medeiros, J.P.S., Cunha, A.C., Brito Jr., A.M., Pires, P.S.M.: Automating security tests for industrial automation devices using neural networks. In: Proc. IEEE Conference on Emerging Technologies and Factory Automation (ETFA 2007), pp. 772–775 (2007)
Deza, E., Deza, M.M.: Dictionary of Distances. Elsevier Science, Amsterdam (2006)
NetBSD Project: Products based on NetBSD (2009), http://www.netbsd.org/gallery/products.html
Author information
Authors and Affiliations
Editor information
Editors and Affiliations
Rights and permissions
Copyright information
© 2010 Springer-Verlag Berlin Heidelberg
About this paper
Cite this paper
Medeiros, J.P.S., Brito, A.M., Motta Pires, P.S. (2010). An Effective TCP/IP Fingerprinting Technique Based on Strange Attractors Classification. In: Garcia-Alfaro, J., Navarro-Arribas, G., Cuppens-Boulahia, N., Roudier, Y. (eds) Data Privacy Management and Autonomous Spontaneous Security. DPM SETOP 2009 2009. Lecture Notes in Computer Science, vol 5939. Springer, Berlin, Heidelberg. https://doi.org/10.1007/978-3-642-11207-2_16
Download citation
DOI: https://doi.org/10.1007/978-3-642-11207-2_16
Publisher Name: Springer, Berlin, Heidelberg
Print ISBN: 978-3-642-11206-5
Online ISBN: 978-3-642-11207-2
eBook Packages: Computer ScienceComputer Science (R0)