A REVIEW ON OPERATING SYSTEM CLASSIFICATION WITH MACHINE LEARNING USING TCP/IP AND TLS INFORMATION

Abstract

It is an issue of both security and management for all network administrators to determine the Operating Systems (OS) that are using their network. Identification of Operating Systems in any kind of network has been a real challenge due to the rapid changes of the encryption protocols and the quick enlargement of the data. In order to solve this problem, there are plenty active and passive fingerprinting methods than can lead to finding the real OS behind the traffic, but on top of these outdated methods, the one that has a great interest from all researchers is undoubtfully using Machine Learning (ML). The difficulties in this field starts from building the dataset, to choosing the best algorithm to find the OS from some simple features of TCP/IP packets or from TLS handshake information. In this thesis we will show how can OS fingerprinting can be achieved with machine learning and what are the tools that one may need to do this task. We will state also different methods of OS fingerprinting using network traffic.