LNCS 2820 - Ambiguity Resolution via Passive OS Fingerprinting

202 G. Taleck
that failed (either the SYN table or one of the 16 SYNACK sub-tables) and
tally a score for each field. Once all fingerprint scores have been calculated, the
highest score wins.
6 Resource Consumption
With ever-increasing network speeds, it is important for the network analysis of
packets by an IDS to be as fast as possible. To this end, a number of optimizations
have been made to satisfy the constraints placed on the IDS sensor.
6.1 On-demand Resolution
Since detecting the OS type can be an O(n) operation, the SYN and SYNACK
data from an IP are cached in a tree based upon the IP address of the host. To
prevent dubious SYN/SYNACK entries from flooding the cache, the insertion
is only done once the three-way handshake is complete and we understand a
complete connection has been made. There is little sense in occupying resources
for some port scan or even a flood.
When an ambiguity arises in future traffic received by the IDS, a lookup is
performed on the IP address of the host receiving the ambiguous packets, and
a decision is made as to how to resolve the ambiguity. With this approach, only
costly operations are performed when necessitated by the network traffic.
6.2 Fingerprint Caching
As described in the previous section, when an ambiguity arises, a lookup is
made into the IP SYN/SYNACK cache. If an entry is found that matches the
destination IP address of the packet(s) containing the ambiguity, the values of
the SYN/SYNACK entry are used to look up the OS type in a fingerprint cache.
Since the IDS does not perform any computationally intensive operations
until an ambiguity arises, the average runtime cost is merely the cost of caching
SYN and SYNACK information. The resulting computational overhead is negligible.
At cold start, this cache is initialized to contain all the fingerprints of the
database, built as described in Section 4. During runtime, if the lookup of the
OS type in the fingerprint cache fails, the best-match algorithm is invoked to
make a best guess. This resulting value is then inserted as a new entry into the
fingerprint cache, such that any following lookup will result in a cache hit.
6.3 Memory Utilization
The two caches used for the SYN/SYNACK lookup tree and the OS fingerprint
tree can grow to very large sizes. Even though the amount of memory per entry
may be small, an IDS monitoring a large network can quickly expand the size of
these caches. Our implementation does not limit the size of these caches; rather,