System and method for operating system distribution and version identification using communications security fingerprints
A system and method for inferring an operating system version for a device based on communications security data. A method includes identifying a plurality of sequences in communications security data sent by the device; determining an operating system type of an operating system used by the device based on the identified plurality of sequences; applying a version-identifying model to the identified plurality of sequences, wherein the version-identifying model is a machine learning model trained to output a version identifier, wherein the applied version-identifying model is associated with the determined operating system type; and determining the operating system version of the device based on the output of the version-identifying model.
1. A method for inferring an operating system version for a device based on communications security data, comprising:
extracting a set of features from communications security data sent by a first device, wherein the communications security data comprises part of a handshake to establish an encrypted connection based on an elliptic-curve cryptography protocol;
applying a plurality of sequence-based machine-learning models without explicit rules defining sequences to identify a plurality of sequences for a corresponding plurality of lists in the features wherein the plurality of lists identifies ciphers, extension types, or elliptic curves compatible with the device;
determining an operating system type of an operating system used by the device based on the identified plurality of sequences;
iteratively applying a version-identifying model to the identified plurality of sequences, wherein the version-identifying model is a machine learning model trained to output a version identifier, wherein the applied version-identifying model is associated with the determined operating system type, wherein the version-identifying model is iterated using different identified sequences as inputs for different earlier iterations, wherein results of the earlier iterations are combined and classified to produce a single output; and
determining the operating system version of the device based on the output of the version-identifying model.
2. The method of claim 1 , wherein the version-identifying model is a hierarchical classifier configured to iterate over the plurality of sequences.
3. The method of claim 1 , wherein the plurality of sequence-based machine learning models are applied to features extracted from the communications security data sent by the device, wherein each sequence-based machine learning model is a machine learning model associated with a respective operating system, wherein each sequence-based machine learning model is trained based on a training data set including training communications security data sent by training devices using the respective operating system.
4. The method of claim 1 , wherein determining the operating system type further comprises:
applying an operating system (OS)-identifying model to the plurality of sequences, wherein the OS-identifying model is a machine learning model trained to output a plurality of probabilities, wherein each probability is associated with a respective class representing a potential operating system used by the device, wherein the version-identifying model is further applied to the plurality of probabilities.
5. The method of claim 1 , wherein the plurality of sequences includes at least one of: cipher sequences, extension sequences, and elliptic curve sequences.
6. The method of claim 1 , wherein each identified sequence is associated with a respective operating system type of a plurality of operating system types, wherein the determined operating system type for the device is one of the plurality of operating system types.
7. The method of claim 1 , wherein the communications security data sent by the device includes data sent during a communications security handshake.
8. The method of claim 1 , wherein the communications security data sent by the device is according to a transport layer security protocol.
9. The method of claim 1 , further comprising:
monitoring activity of the device to detect abnormal behavior based on the determined operating system version of the device; and
performing at least one mitigation action when the abnormal behavior is detected.
10. A non-transitory computer readable medium having stored thereon instructions for causing a processing circuitry to execute a process, the process comprising:
extracting a set of features from communications security data sent by a first device, wherein the communications security data comprises part of a handshake to establish an encrypted connection based on an elliptic-curve cryptography protocol;
applying a plurality of sequence-based machine-learning models without explicit rules defining sequences to identify a plurality of sequences for a corresponding plurality of lists in the features, wherein the plurality of lists identifies ciphers, extension types, or elliptic curves compatible with the device;
determining an operating system type of an operating system used by the device based on the identified plurality of sequences;
iteratively applying a version-identifying model to the identified plurality of sequences, wherein the version-identifying model is a machine learning model trained to output a version identifier, wherein the applied version-identifying model is associated with the determined operating system type, wherein the version-identifying model is iterated using different identified sequences as inputs for different earlier iterations, wherein results of the earlier iterations are combined and classified to produce a single output; and
determining an operating system version of the device based on an output of the version-identifying model.
11. A system for inferring an operating system version for a device based on communications security data, comprising:
a processing circuitry; and
a memory, the memory containing instructions that, when executed by the processing circuitry, configure the system to:
extract a set of features from communications security data sent by a first device, wherein the communications security data comprises part of a handshake to establish an encrypted connection based on an elliptic-curve cryptography protocol;
apply a plurality of sequence-based machine-learning models without explicit rules defining sequences to identify a plurality of sequences for a corresponding plurality of lists in the features, wherein the plurality of lists identifies ciphers, extension types, or elliptic curves compatible with the device;
determine an operating system type of an operating system used by the device based on the identified plurality of sequences;
iteratively apply a version-identifying model to the identified plurality of sequences, wherein the version-identifying model is a machine learning model trained to output a version identifier, wherein the applied version-identifying model is associated with the determined operating system type, wherein the version-identifying model is iterated using different identified sequences as inputs for different earlier iteration, wherein results of the earlier iterations are combined and classified to produce a single output; and
determine the operating system version of the device based on the output of the version-identifying model.
12. The system of claim 11 , wherein the version-identifying model is a hierarchical classifier configured to iterate over the plurality of sequences.
13. The system of claim 11 , wherein the plurality of sequence-based machine learning models are applied to features extracted from the communications security data sent by the device, wherein each sequence-based machine learning model is a machine learning model associated with a respective operating system, wherein each sequence-based model is trained based on a training data set including training communications security data sent by training devices using the respective operating system.
14. The system of claim 11 , wherein the system is further configured to:
apply an operating system (OS)-identifying model to the plurality of sequences, wherein the OS-identifying model is a machine learning model trained to output a plurality of probabilities, wherein each probability is associated with a respective class representing a potential operating system used by the device, wherein the version-identifying model is further applied to the plurality of probabilities.
15. The system of claim 11 , wherein the plurality of sequences includes at least one of: cipher sequences, extension sequences, and elliptic curve sequences.
16. The system of claim 11 , wherein each identified sequence is associated with a respective operating system type of a plurality of operating system types, wherein the determined operating system type for the device is one of the plurality of operating system types.
17. The system of claim 11 , wherein the communications security data sent by the device includes data sent during a communications security handshake.
18. The system of claim 11 , wherein the communications security data sent by the device is according to a transport layer security protocol.
19. The system of claim 11 , wherein the system is further configured to:
monitor activity of the device to detect abnormal behavior based on the determined operating system version of the device; and
perform at least one mitigation action when the abnormal behavior is detected.
20. The method of claim 1 , wherein the device is a first device, wherein the plurality of sequences of communications security data sent by the first device are sent to a second device, and wherein determining the operating system version of the first device.