通过符合预测实现可靠的分层操作系统指纹识别
Reliable Hierarchical Operating System Fingerprinting via Conformal Prediction
AI总结：
本文提出两种结构化符合预测方法，用于改进操作系统指纹识别的可靠性与一致性。
摘要：
操作系统（OS）指纹识别对于网络安全至关重要，但传统方法不提供正式的不确定性量化机制。符合预测（CP）可以围绕现有方法直接包装，以获得具有保证覆盖的预测集。然而，直接应用CP会将操作系统识别视为一个扁平分类问题，忽略了操作系统自然的等级结构，并提供脆弱的点预测。本文通过引入并评估两种不同的结构化CP策略来解决这些限制：层级式CP（L-CP），它独立校准每个层级；以及基于投影的CP（P-CP），它通过将叶级集向上投影来确保结构一致性。我们的结果表明，虽然两种方法都满足有效性保证，但它们暴露了在层级效率和结构一致性之间的根本权衡。L-CP产生更紧的预测集，适合人类取证分析，但存在分类不一致的问题。相反，P-CP保证了层次一致、嵌套的集，适合自动化策略执行，但以更粗层次的效率降低为代价。
英文摘要：
Operating System (OS) fingerprinting is critical for network security, but conventional methods do not provide formal uncertainty quantification mechanisms. Conformal Prediction (CP) could be directly wrapped around existing methods to obtain prediction sets with guaranteed coverage. However, a direct application of CP would treat OS identification as a flat classification problem, ignoring the natural taxonomic structure of OSs and providing brittle point predictions. This work addresses these limitations by introducing and evaluating two distinct structured CP strategies: level-wise CP (L-CP), which calibrates each hierarchy level independently, and projection-based CP (P-CP), which ensures structural consistency by projecting leaf-level sets upwards. Our results demonstrate that, while both methods satisfy validity guarantees, they expose a fundamental trade-off between level-wise efficiency and structural consistency. L-CP yields tighter prediction sets suitable for human forensic analysis but suffers from taxonomic inconsistencies. Conversely, P-CP guarantees hierarchically consistent, nested sets ideal for automated policy enforcement, albeit at the cost of reduced efficiency at coarser levels.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
