arXiv：cs.LG· Jae Sung Kim, Spencer Ekeroth, Jeremy Neale·· 3 小时前
用机器学习优化 OS 指纹识别：OsirisML 在 CIC-IDS2017 上最高达 97.66% 准确率
Machine Learning Optimization for Enhanced OS Fingerprinting
AI 导读
研究提出命令行工具 OsirisML，用 nPrint 将数据预处理为表格数据、以 XGBoost 训练模型，在 CIC-IDS2017 数据集上被动识别操作系统。随机划分训练与测试时，模型在周五抓包的下采样子集上准确率达 97.66%，整份抓包为 84.69%。在无攻击的周一整份抓包上，准确率为 73.83%，F-1 分数为 79.38%。
正文
Abstract:Operating System (OS) Fingerprinting is a technique that can be used to identify a network's operating systems by evaluating network traffic in the form of TCP/IP packets. This research will explore the effectiveness of passively identifying operating systems on the CIC-IDS2017 dataset, a collection of over 47 gigabytes of pcap files with their corresponding operating systems. This research also proposes a new command line interface, OsirisML, which uses nPrint to preprocess the data into tabular data and XGBoost to apply ML to the data to generate, retrain, and test ML models. When packets are split randomly between training and testing, OsirisML models reach an accuracy of 97.66% on a down-sampled subset of the Friday capture and 84.69% on the entire capture. On the entire Monday capture, which contains no attacks, OsirisML reaches an accuracy of 73.83% and an F-1 score of 79.38%.
| Comments: | 7 pages, 2 figures, 1 table |
| Subjects: | Machine Learning (cs.LG) |
| ACM classes: | C.2.3; I.2.6 |
| Cite as: | arXiv:2610.11133 [cs.LG] |
| (or arXiv:2610.11133v1 [cs.LG] for this version) | |
| https://doi.org/10.48550/arXiv.2610.11133 arXiv-issued DOI via DataCite (pending registration) |
Submission history
From: Jae Sung Kim [view email]
[v1]
Thu, 8 Oct 2026 02:58:09 UTC (434 KB)
来源：arXiv：cs.LG · arxiv.org