Method and system for preventing operating system detection

1. A method for preventing detection of an operating system on a network by an intruder, the operating system installed on a host in a computer network, the method comprising

receiving, at the host, a network probe from the intruder for detection of the operating system;

identifying a type of the network probe; and

generating, by the operating system of the host, a response to the network probe, the response generated based on a type of the operating system;

modifying, using the host, the response to the network probe generated by the operating system based on the type of the network probe identified, wherein the modified response provides false information related to the operating system such the intruder cannot detect the type of the operating system based on the modified response; and

sending, using the host, the response to the intruder.

2. The method of claim 1 wherein modifying the response to the network probe further comprises adding a code in an appropriate communication stack level of the host's operating system.

3. The method of claim 1 wherein if the network probe is a FIN probe, modifying the response comprises blocking the network probe.

4. The method of claim 3 further comprising randomizing an acknowledgement value in response to the FIN probe.

5. The method of claim 1 wherein if the network probe is a BOGUS probe, modifying the response comprises removing all flags of the network probe.

6. The method of claim 1 wherein modifying the response comprises removing TCP timestamp values from the generated response if the network probe uses Transport Control Protocol (TCP) timestamp values for the operating system detection.

7. The method of claim 1 , wherein modifying the response comprises making all IP identification (IPID) values zero if the network probe uses IPID sampling for the operating system detection.

8. The method of claim 1 wherein modifying the response comprises setting a don't fragment (DF) bit on the generated response if the network probe uses the DF bit for the operating system detection.

9. The method of claim 1 wherein modifying the response comprises limiting the number of Internet control messaging protocol (ICMP) error messages to a predefined value on the generated response if the network probe uses the number of ICMP error messages for the operating system detection.

10. The method of claim 1 wherein modifying the response comprises adjusting the size of a TCP window to a predefined value if the network probe uses the size of TCP window for the operating system detection.

11. The method of claim 1 wherein modifying the response comprises making the Type of Service (TOS) value zero if the network probe uses the TOS value for the operating system detection.

12. The method of claim 1 , wherein modifying the response comprises removing all TCP options if the network probe uses the TCP options for the operating system detection.

13. A system for preventing the detection of an operating system on a network by an intruder, the operating system installed on a host in a computer network, the system comprising

a network probe identifier for receiving, at the host, a network probe from the intruder for detection of the operating system and identifying a type of the network probe;

an operating system for generating a response to the network probe, the response generated based on a type of the operating system;

a response modifier for modifying, using the host, the response to the network probe generated by the operating system based on the type of the network probe identified, wherein the modified response provides false information related to the operating system such the intruder cannot detect the type of the operating system based on the modified response; and

a response sender for sending the response to the intruder.

14. The system of claim 13 wherein the response modifier removes TCP time stamp values from the generated response if the network probe uses TCP timestamp values for operating system detection.

15. The system of claim 14 wherein the response modifier limits the number of ICMP error messages to a pre-defined value on the generated response.

16. The system of claim 13 , wherein the response modifier adjusts the size of a TCP window to a predefined value if the network probe uses the size of TCP window for the operating system detection.

17. The system of claim 13 , wherein the response modifier makes the Type of Service (TOS) value zero if the network probe uses the TOS value for the operating system detection.

18. The system of claim 13 , wherein the response modifier removes all the TCP options if the network probe uses the TCP options for the operating system detection.

19. The system of claim 13 , wherein the response modifier blocks the network probe if the network probe is a FIN probe.

20. The system of claim 13 , wherein the response modifier removes all the flags of the network probe if the network probe is a BOGUS probe.

21. A system for preventing the detection of an operating system on a network by an intruder, the operating system installed on a host in a computer network, the system comprising

means for receiving, at the host, a network probe from the intruder for detection of the operating system;

means for identifying a type of the network probe; and

means for for generating, by the operating system of the host, a response to the network probe, the response generated based on a type of the operating system;

means for modifying, using the host, the response to the network probe generated by the operating system based on the type of the network probe identified, wherein the modified response provides false information related to the operating system such the intruder cannot detect the type of the operating system based on the modified response; and

means for for sending, using the host, the response to the intruder.

22. The system of claim 21 wherein the means for modifying the response removes TCP timestamp values from the generated response to the network probe.

23. The system of claim 21 wherein the means for modifying the response limits the number of ICMP error messages to a pre-defined value on the generated response.

24. The system of claim 21 , wherein the means for modifying the response adjusts the size of a TCP window to a predefined value if the network probe uses the size of TCP window for the operating system detection.

25. The system of claim 21 , wherein the means for modifying the response makes the Type of Service (TOS) value zero if the network probe uses the TOS value for the operating system detection.

26. The system of claim 21 , wherein the means for modifying the response removes all the TCP options if the network probe uses the TCP options for the operating system detection.

27. The system of claim 21 , wherein the means for modifying the response blocks the network probe if the network probe is a FIN probe.

28. The system of claim 21 , wherein the means for modifying the response removes all the flags of the network probe if the network probe is a BOGUS probe.

29. An apparatus for preventing the detection of an operating system on a network by an intruder, the operating system installed on a host in a computer network, the apparatus comprising

a processing system including a processor coupled to a display and user input device;

a machine-readable medium including instructions executable by the processor comprising

one or more instructions for receiving, at the host, a network probe from the intruder for detection of the operating system;

one or more instructions for identifying a type of the network probe; and

one or more instructions for generating, by the operating system of the host, a response to the network probe, the response generated based on a type of the operating system;

one or more instructions for modifying, using the host, the response to the network probe generated by the operating system based on the type of the network probe identified, wherein the modified response provides false information related to the operating system such the intruder cannot detect the type of the operating system based on the modified response; and

one or more instructions for sending, using the host, the response to the intruder.

30. A machine-readable medium including instructions executable by the processor for preventing the detection of an operating system on a network by an intruder, the operating system installed on a host in a computer network, the machine-readable medium comprising

one or more instructions for receiving, at the host, a network probe from the intruder for detection of the operating system;

one or more instructions for identifying a type of the network probe; and

one or more instructions for generating, by the operating system of the host, a response to the network probe, the response generated based on a type of the operating system;

one or more instructions for modifying, using the host, the response to the network probe generated by the operating system based on the type of the network probe identified, wherein the modified response provides false information related to the operating system such the intruder cannot detect the type of the operating system based on the modified response; and

one or more instructions for sending, using the host, the response to the intruder.