PTF: Passive Temporal Fingerprinting

Jérôme François (1, 2) , Humberto Abdelnur (1) , Radu State (2, 3) , Olivier Festor (1)

1 MADYNES - Management of dynamic networks and services
2 SnT - Interdisciplinary Centre for Security Relaibility and Trust
3 Uni.lu - Université du Luxembourg

We describe in this paper a tool named PTF (Passive and Temporal Fingerprinting) for fingerprinting network devices. The objective of device fingerprinting is to uniquely identify device types by looking at captured traffic from devices imple- menting that protocol. The main novelty of our approach consists in leveraging both temporal and behavioral features for this purpose. The key contribution is a fingerprinting scheme, where individual fingerprints are represented by tree-based temporal finite state machines. We have developed a fingerprinting scheme that leverages supervised learning approaches based on support vector machines for this purpose.

Domaines: Réseaux et télécommunications [cs.NI]

Jérôme François, Humberto Abdelnur, Radu State, Olivier Festor. PTF: Passive Temporal Fingerprinting. 12th IFIP/IEEE International Symposium on Integrated Network Management - IM'2011, May 2011, Dublin, Ireland. 8 p. ⟨hal-00645299⟩