用于增强操作系统指纹识别的机器学习优化
Machine Learning Optimization for Enhanced OS Fingerprinting
浏览论文内容
中文总结 AI 辅助
本研究针对操作系统指纹识别问题，提出了基于nPrint和XGBoost的命令行工具OsirisML，在CIC-IDS2017数据集上实现了较高的识别准确率，为网络操作系统识别提供了优化方案。
中文摘要 AI 辅助
操作系统（OS）指纹识别是一种通过评估TCP/IP数据包形式的网络流量来识别网络操作系统的技术。本研究将探索在CIC-IDS2017数据集上被动识别操作系统的有效性，该数据集是包含对应操作系统的超过47GB的pcap文件集合。本研究还提出了一个新的命令行界面OsirisML，它使用nPrint将数据预处理为表格数据，并使用XGBoost对数据应用机器学习以生成、重新训练和测试机器学习模型。当数据包在训练集和测试集之间随机划分时，OsirisML模型在周五捕获的下采样子集上达到97.66%的准确率，在整个周五捕获集上达到84.69%的准确率；在不包含攻击的整个周一捕获集上，OsirisML达到73.83%的准确率和79.38%的F1分数。
英文摘要
Operating System (OS) Fingerprinting is a technique that can be used to identify a network's operating systems by evaluating network traffic in the form of TCP/IP packets. This research will explore the effectiveness of passively identifying operating systems on the CIC-IDS2017 dataset, a collection of over 47 gigabytes of pcap files with their corresponding operating systems. This research also proposes a new command line interface, OsirisML, which uses nPrint to preprocess the data into tabular data and XGBoost to apply ML to the data to generate, retrain, and test ML models. When packets are split randomly between training and testing, OsirisML models reach an accuracy of 97.66% on a down-sampled subset of the Friday capture and 84.69% on the entire capture. On the entire Monday capture, which contains no attacks, OsirisML reaches an accuracy of 73.83% and an F-1 score of 79.38%.
发表机构
- Virginia Tech（弗吉尼亚理工大学）
机构由 AI 辅助整理，请以论文原文为准。
