Incremental Fingerprinting in an Open World
For network security practitioners, this work addresses the practical limitation of closed-world fingerprinting by enabling identification of unknown protocol implementations, reducing misclassifications.
This paper introduces an open-world variant of network protocol fingerprinting, where not all implementation models are known in advance, and proposes an incremental approach combining active automata learning with closed-world fingerprinting to reduce misclassifications and interactions. Experimental results on various protocols show significant reductions in misclassifications and interactions.
Network protocol fingerprinting is used to identify a protocol implementation by analyzing its input-output behavior. Traditionally, fingerprinting operates under a closed-world assumption, where models of all implementations are assumed to be available. However, this assumption is unrealistic in practice. When this assumption does not hold, fingerprinting results in numerous misclassifications without indicating that a model for an implementation is missing. Therefore, we introduce an open-world variant of the fingerprinting problem, where not all models are known in advance. We propose an incremental fingerprinting approach to solve the problem by combining active automata learning with closed-world fingerprinting. Our approach quickly determines whether the implementation under consideration matches an available model using fingerprinting and conformance checking. If no match is found, it learns a new model by exploiting the structure of available models. We prove the correctness of our approach and improvements in asymptotic complexity compared to naive baselines. Moreover, experimental results on a variety of protocols demonstrate a significant reduction in misclassifications and interactions with these black-boxes.