Semi-Supervised Fingerprinting of Protocol Messages

Jérôme François (1, 2) , Humberto Abdelnur (1) , Radu State (3) , Olivier Festor (1)

1 MADYNES - Management of dynamic networks and services
2 SnT - Interdisciplinary Centre for Security Relaibility and Trust
3 Uni.lu - Université du Luxembourg

This paper addresses the fingerprinting of network devices using semi-supervised clustering. Semi-supervised clustering is a new technique that uses known and labeled data in order to assist a clustering process. We propose two different fingerprinting approaches. The first one is using behavioral features that are induced from a protocol state machine. The second one is relying on the underlying parse trees of messages. Both approaches are passive. We provide a performance analysis on the SIP protocol. Important application domains of our work consist in network intrusion detection and security assessment.

Domaines: Réseaux et télécommunications [cs.NI]

Jérôme François, Humberto Abdelnur, Radu State, Olivier Festor. Semi-Supervised Fingerprinting of Protocol Messages. CISIS 2010 - 3rd International Conference on Computational Intelligence in Security for Information Systems, Nov 2010, Léon, Spain. pp.107-115, ⟨10.1007/978-3-642-16626-6_12⟩. ⟨inria-00536067⟩