Advanced Network Fingerprinting - Inria - Institut national de recherche en sciences et technologies du numérique Accéder directement au contenu
Communication Dans Un Congrès Lecture Notes in Computer Science Année : 2008

Advanced Network Fingerprinting

Radu State
  • Fonction : Auteur
  • PersonId : 755670
  • IdRef : 059893591

Résumé

Security assessment tasks and intrusion detection systems do rely on automated fingerprinting of devices and services. Most current fingerprinting approaches use a signature matching scheme, where a set of signatures are compared with traffic issued by an unknown entity. The entity is identified by finding the closest match with the stored signatures. These fingerprinting signatures are found mostly manually, requiring a laborious activity and needing advanced domain specific expertise. In this paper we describe a novel approach to automate this process and build flexible and efficient fingerprinting systems able to identify the source entity of messages in the network. We follow a passive approach without need to interact with the tested device. Application level traffic is captured passively and inherent structural features are used for the classification process. We describe and assess a new technique for the automated extraction of protocol fingerprints based on arborescent features extracted from the underlying grammar. We have successfully applied our technique to the Session Initiation Protocol (SIP) used in Voice over IP signalling.
Fichier principal
Vignette du fichier
Advanced_Network_Fingerprinting.pdf (604.14 Ko) Télécharger le fichier
Origine : Fichiers produits par l'(les) auteur(s)
Loading...

Dates et versions

inria-00326054 , version 1 (01-10-2008)

Identifiants

Citer

Humberto Abdelnur, Radu State, Olivier Festor. Advanced Network Fingerprinting. Recent Advances in Intrusion Detection, MIT, Sep 2008, Boston, United States. pp.372-389, ⟨10.1007/978-3-540-87403-4⟩. ⟨inria-00326054⟩
152 Consultations
1988 Téléchargements

Altmetric

Partager

Gmail Facebook X LinkedIn More