Reliable Hierarchical Operating System Fingerprinting via Conformal Prediction
This work addresses network security by providing reliable uncertainty quantification for OS identification, though it is incremental as it builds on existing conformal prediction methods.
The paper tackled the problem of operating system fingerprinting lacking formal uncertainty quantification by introducing two structured conformal prediction strategies, L-CP and P-CP, which satisfy validity guarantees but reveal a trade-off between efficiency and structural consistency.
Operating System (OS) fingerprinting is critical for network security, but conventional methods do not provide formal uncertainty quantification mechanisms. Conformal Prediction (CP) could be directly wrapped around existing methods to obtain prediction sets with guaranteed coverage. However, a direct application of CP would treat OS identification as a flat classification problem, ignoring the natural taxonomic structure of OSs and providing brittle point predictions. This work addresses these limitations by introducing and evaluating two distinct structured CP strategies: level-wise CP (L-CP), which calibrates each hierarchy level independently, and projection-based CP (P-CP), which ensures structural consistency by projecting leaf-level sets upwards. Our results demonstrate that, while both methods satisfy validity guarantees, they expose a fundamental trade-off between level-wise efficiency and structural consistency. L-CP yields tighter prediction sets suitable for human forensic analysis but suffers from taxonomic inconsistencies. Conversely, P-CP guarantees hierarchically consistent, nested sets ideal for automated policy enforcement, albeit at the cost of reduced efficiency at coarser levels.