Areas | Projects | Researchers | Publications | Advisories | Tools | Brainstormings
  

Using neural networks for OS fingerprinting

The problem of remote Operating System (OS) Detection, also called OS Fingerprinting or OS Identification, is a crucial step of the penetration test process, since the attacker (hacker or security professional) needs to know the OS of the target host in order to choose the exploits that he will use. It can thus be viewed as part of the Attack Planning problem.
OS Detection is accomplished by passively sniffing network packets and actively sending test packets to the target host, to study specific variations in the host response revealing its operating system.

The first fingerprinting implementations were based on the analysis of differences between TCP/IP stack implementations. The next generation focused the analysis on application layer data such as the DCE RPC endpoint information. Even though more information was analized, some variation of the "best fit" algorithm was still used to interpret this new information. This strategy suffers from the weaknessthat it will not work in non-standard situations and the inability to extract the key elements which uniquely identify an operating system. We think that the next step is to focus on the algorithm used to analyze the data rather than the data itself.

Our new approach involves an analysis of the composition of the information collected during the OS identification process to identify key elements and their relations. To implement this approach, we have developed tools using neural networks and techniques from the field of artificial intelligence which have been successfully integrated into commercial software (Core Impact).

Papers and Presentations