Using Neural Networks for Remote OS Detection
The problem of remote Operating System (OS) Detection,
also called OS Fingerprinting or OS Identification, is a crucial
step of the penetration test process, since the attacker (hacker
or security professional) needs to know the OS of the target host
in order to choose the exploits that he will use. It can thus be
viewed as part of the Attack Planning problem.
OS Detection is accomplished by passively sniffing network packets
and actively sending test packets to the target host, to study specific
variations in the host response revealing its operating system.
The first fingerprinting implementations were based
on the analysis of differences between TCP/IP stack implementations.
The next generation focused the analysis on application layer data
such as the DCE RPC endpoint information. Even though more information
was analized, some variation of the "best fit" algorithm
was still used to interpret this new information. This strategy
suffers from the weaknessthat it will not work in non-standard situations
and the inability to extract the key elements which uniquely identify
an operating system. We think that the next step is to focus on
the algorithm used to analyze the data rather than the data itself.
Our new approach involves an analysis of the
composition of the information collected during the OS identification
process to identify key elements and their relations. To implement
this approach, we have developed tools using neural networks and
techniques from the field of artificial intelligence which have
been successfully integrated into commercial software (Core Impact).
Project Resources:
« Back to Projects List
