超越神经元研究类企业奖技术的局限
Outrepasser les limites des techniques classiques de Prise d'Empreintes grace aux Reseaux de Neurones
摘要：
本文介绍了人工智能技术在信息安全领域的应用。远程操作系统（OS）检测（也称为OS指纹识别）问题是渗透测试过程的关键步骤，因为攻击者（黑客或安全专业人员）需要知道目标主机的OS以便选择他将使用的漏洞。操作系统检测通过被动嗅探网络数据包并主动向目标主机发送测试数据包来完成，以研究主机响应中的特定变化，从而揭示有关其操作系统的信息。第一个指纹识别实现是基于对TCP/IP协议栈实现之间差异的分析。下一代将分析重点放在应用程序层数据上，如DCERPC端点信息。尽管分析了更多的信息，但仍然使用“最佳拟合”算法的一些变体来解释这些新信息。我们的新方法包括分析在OS识别过程中收集的信息的组成，以确定关键元素及其关系。为了实现这种方法，我们开发了使用神经网络和统计领域技术的工具。这些工具已成功地集成到一个商业软件（核心影响）。
英文摘要：
We present an application of Artificial Intelligence techniques to the field of Information Security. The problem of remote Operating System (OS) Detection, also called OS Fingerprinting, is a crucial step of the penetration testing process, since the attacker (hacker or security professional) needs to know the OS of the target host in order to choose the exploits that he will use. OS Detection is accomplished by passively sniffing network packets and actively sending test packets to the target host, to study specific variations in the host responses revealing information about its operating system. The first fingerprinting implementations were based on the analysis of differences between TCP/IP stack implementations. The next generation focused the analysis on application layer data such as the DCE RPC endpoint information. Even though more information was analyzed, some variation of the "best fit" algorithm was still used to interpret this new information. Our new approach involves an analysis of the composition of the information collected during the OS identification process to identify key elements and their relations. To implement this approach, we have developed tools using Neural Networks and techniques from the field of Statistics. These tools have been successfully integrated in a commercial software (Core Impact).
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
