Fine-Grained Passive Operating System Identification Based on Network Traffic Sequences

For the problem of passive operating system fingerprinting in encrypted traffic, most existing methods identify operating systems by extracting TCP/IP protocol features and flow statistics from individual session flows and applying machine learning techniques. While these approaches perform well in identifying OS types, their accuracy in distinguishing OS versions remains limited due to the similarity in TCP/IP stack implementations across different versions of the same OS. To address this issue, this paper proposes a traffic-sequence-based method for OS and version identification. First, multiple consecutive session flows from a host are captured and grouped into a sequence. TCP/IP protocol features and flow statistics are then extracted for each session. By constructing a bidirectional GRU(Gated Recurrent Unit)model, dependencies between session flow sequences are incorporated on top of the existing features. Compared with current methods, this approach achieves high identification accuracy and performs well across different OS versions.