用表格型Transformer提升操作系统指纹识别准确率
Application of Tabular Transformer Architectures for Operating System Fingerprinting
- 采用TabTransformer和FT-Transformer处理结构化网络数据
- FT-Transformer在多个版本层级上超越传统方法
- 适合网络安全与网络管理方向的研究者参考
操作系统指纹识别对网络管理和网络安全至关重要，可基于网络流量分析实现设备精准识别。传统规则工具如Nmap和p0f在动态环境中面临挑战，因系统频繁更新及混淆技术。尽管已有机器学习方法探索，深度学习模型尤其是Transformer架构在此领域仍待开发。本研究评估了表格型Transformer模型——TabTransformer与FT-Transformer——在操作系统指纹识别中的应用，利用三个公开数据集的结构化网络数据。实验表明，FT-Transformer在多个分类层级（操作系统家族、主版本、次版本）上普遍优于传统机器学习模型、先前方法及TabTransformer。结果为基于深度学习的指纹识别奠定了坚实基础，提升了复杂网络环境下的准确性和适应性。此外，研究提供开源实现以确保可复现性。
原文摘要 · Abstract (English)
Operating System (OS) fingerprinting is essential for network management and cybersecurity, enabling accurate device identification based on network traffic analysis. Traditional rule-based tools such as Nmap and p0f face challenges in dynamic environments due to frequent OS updates and obfuscation techniques. While Machine Learning (ML) approaches have been explored, Deep Learning (DL) models, particularly Transformer architectures, remain unexploited in this domain. This study investigates the application of Tabular Transformer architectures-specifically TabTransformer and FT-Transformer-for OS fingerprinting, leveraging structured network data from three publicly available datasets. Our experiments demonstrate that FT-Transformer generally outperforms traditional ML models, previous approaches and TabTransformer across multiple classification levels (OS family, major, and minor versions). The results establish a strong foundation for DL-based OS fingerprinting, improving accuracy and adaptability in complex network environments. Furthermore, we ensure the reproducibility of our research by providing an open-source implementation.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。