8002824269

Passive operating system fingerprinting using neural networks... 19

too. The multi-stage architecture was build only for systems that meet the minimum 1% occurrence of ąuantity (Windows, Linux, BSD, etc).

Passive operating system fingerprinting using neural networks... 19

Recognitionot OS

name RecognitionOS \/ersion

	Recognition of OS name	RecognitionOS version
■ Learning set	99,80%	96,50%
■ Testing set	97,70%	85%

Figurę 4. Results by recognition depth

One should notę that: for modified TCP/IP stacks and when the original signatures were not placed in the training set - the network gives 97,7% correct classification ratę. When trying to additionally determine the exact version of the OS - the ratę dropped, but still was very high - 85%.

4. Induction of decision rules, Pareto-optimal rules

To have a better understanding of the data set we also decided to do the induction of decision rules. Discovering interesting and statistically relevant rules may allow to per-form simple OS fingerprinting without a neural network classifier, sińce ‘if-then’ rules are of high interpretive value for humans.

10 10 1

Figurę 5. Best neural network topology (3 layers, 10 neurons in every hidden layer)