Reliable Hierarchical Operating System Fingerprinting via Conformal Prediction

Alejandro Pazos; Jose V\'azquez-Naya; Osvaldo Simeone; Rub\'en P\'erez-Jove

REVIEW 3 major objections 4 minor 37 references

Reliable Hierarchical Operating System Fingerprinting via Conformal Prediction

T0 review · 3 major / 4 minor · reviewed 2026-08-02 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read Hierarchical OS fingerprinting can carry formal coverage guarantees via conformal prediction, but only if operators accept a trade-off between tight sets and taxonomically consistent sets.

desk verdict A solid applied CP-for-OS-fingerprinting paper with honest framing, but the formal coverage claim for P-CP is overstated for ragged hierarchies; worth peer review after a targeted fix. read the letter →

arxiv 2602.12825 v1 pith:YWT4CPG6 submitted 2026-02-13 cs.CR cs.LGcs.NI

Rubén Pérez-Jove , Osvaldo Simeone , Alejandro Pazos , Jose Vázquez-Naya This is my paper

classification cs.CRcs.LGcs.NI

keywords OperatingsystemfingerprintingConformalpredictionHierarchicalclassificationUncertaintyquantificationNetworksecuritysetsCoverageguaranteeTaxonomyconsistency

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Operating-system fingerprinting currently outputs a single guessed OS, which can be wrong in ways that matter more at some taxonomic levels than others. The paper wraps conformal prediction around hierarchical OS classifiers so each prediction becomes a set of plausible OS labels with a formal coverage guarantee. It introduces two ways to do this: calibrating each level of the OS tree independently (L-CP), and calibrating leaves then projecting the leaf set upward (P-CP). On 109,663 real traffic flows, both methods hit their nominal coverage targets, but they split on a second property: L-CP produces tighter sets that are often taxonomically inconsistent, while P-CP always produces nested, consistent sets at the cost of larger coarse-level sets. The paper's contribution is making this efficiency-versus-consistency trade-off explicit and measurable through a new Hierarchical Inconsistency Rate.

What carries the argument

The machinery is split conformal prediction applied to a ragged K-level label tree. A nonconformity score of 1 minus the softmax probability is computed for each level; the calibration quantile at level k is the ceiling((n_k+1)(1-alpha_k))/(n_k+1) empirical quantile of calibration scores. L-CP thresholds each level separately, giving P(Y_k in Gamma_k) >= 1-alpha_k per level but no cross-level coherence. P-CP thresholds only the leaf level and defines coarse sets as the set of ancestors with at least one surviving leaf, which forces nesting and transfers leaf coverage upward. The novel Hierarchical Inconsistency Rate counts samples with at least one orphan (child without parent) or sterile (p

What would settle it

Run the same L-CP pipeline on a corpus whose OS labels are verified by controlled installation or manual audit rather than User-Agent parsing, and check empirical family-level coverage at alpha=0.10 over many splits; if L-CP coverage falls below 90% or P-CP family coverage falls below 90%, the paper's central validity claim fails. A simpler check: re-parse a random sample of the dataset's User-Agent strings by hand and measure label disagreement; large disagreement would show the reported coverage is not coverage of true OSs.

Watch

Extended reading notes

Core claim

Both level-wise CP and projection-based CP provide marginal coverage guarantees at each level of an OS taxonomy, but they cannot simultaneously deliver maximal level-wise efficiency and structural consistency. L-CP calibrates a separate conformal threshold at each hierarchy level, yielding prediction sets close to the nominal size but that frequently violate parent-child logic (up to roughly 37% HIR in experiments). P-CP applies conformal prediction only at the leaves and lifts the resulting set to ancestors, which by construction gives nested, HIR=0 sets and inherits leaf coverage at coarser levels, yet inflates coarse-level sets because any retained rare leaf keeps its whole family. Empiri

Load-bearing premise

The coverage guarantees are only as trustworthy as the labels used for calibration: the dataset's OS labels come from HTTP User-Agent strings that may contain parsing errors, so if those labels are wrong the reported coverage overstates performance against the true OS; exchangeability of calibration and test traffic is also assumed.

Editorial extensions

If this is right

Network operators can now select prediction sets with guaranteed coverage instead of point predictions; at alpha=0.10, family-level sets hover around one label while maintaining at least 90% coverage.
For automated policy enforcement, P-CP is the usable option: nested sets make policy checks like 'block all Android except 11+' unambiguous because HIR is zero.
For human forensic triage, L-CP's tighter sets give more useful granularity, and analysts can tolerate or resolve occasional taxonomic contradictions.
Empty-set behavior differs: L-CP abstains more often at coarse levels than P-CP; both abstain more as alpha grows, signaling out-of-distribution traffic.
The trade-off framework and HIR metric extend to any hierarchical classification task with cost-asymmetric errors.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

A hybrid could recover P-CP's lost efficiency: use a coarse-level model to prune families whose leaf mass is negligible, then project remaining leaves upward; this would preserve nesting while tightening coarse sets.
The HIR curve's non-monotonic shape suggests HIR could double as a drift or calibration monitor: if HIR rises at moderate alpha in deployment, the base leaf model may be degrading even if marginal coverage still holds.
The same level-wise/projection trade-off likely appears in other hierarchical security classification domains, such as malware family or device-type identification, not just OS fingerprinting.

Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

Short take: this is a competent, clearly written application paper. It takes two known hierarchical CP schemes, applies them to OS fingerprinting, adds HIR as an evaluation metric, and gives an honest empirical comparison on a public dataset. The methods are not new and the paper does not pretend they are; the citations to Mortier et al. and Zhang et al. are explicit. If you care about hierarchical set-valued prediction or OS fingerprinting with uncertainty quantification, this is worth reading.

What is genuinely new: the HIR metric is simple and useful; the empirical comparison on 109k flows with three taxonomy levels is careful; the 50-run Monte Carlo evaluation is a plus; code and data are public. The L-CP/P-CP trade-off is real and intuitive: L-CP gives tighter sets per level and pays in inconsistent outputs; P-CP is consistent by construction and pays in coarse-level set size. Coverage numbers behave as expected.

Soft spots:

1. The P-CP coverage claim for ragged hierarchies, Eq. (15), is overstated. The proof uses marginal leaf coverage and then says this implies coverage at every coarser level where the ancestor exists. For ragged trees, the subset of points with a defined level-k ancestor is not the whole test distribution, and marginal CP does not control coverage on arbitrary subsets. The paper explicitly allows ragged hierarchies in Sec. 3.1. The implementation avoids the issue by adding generic empty leaf nodes, so the empirical results stand, but the formal statement should be restricted to full-depth hierarchies or changed to a Mondrian/group-conditional guarantee.

2. HIR=0 for P-CP is true by construction, so it is not an empirical discovery. The authors say this themselves, but the abstract and discussion present it as a headline result. Fine as a property; less fine as evidence.

3. No flat-CP baseline. Since the intro dismisses flat CP, they should quantify what hierarchy-aware CP buys over it. Minor, but easy to add.

4. Ground-truth labels come from User-Agent parsing. They admit residual noise, and it is a standard limitation, but it means coverage is measured against possibly wrong labels, and the caveat should be more than a parenthetical.

Overall this is not a paper with a load-bearing flaw. The theory used is standard, the experiments are reproducible, and the central applied claim holds for the full-depth hierarchy used in the experiments. I would send it to peer review, with a request to fix the ragged-hierarchy statement and to add the flat baseline if feasible. It deserves referee time, not a desk rejection.

Referee Report

3 major / 4 minor

Summary. The paper applies split conformal prediction (CP) to hierarchical operating-system fingerprinting. It defines two strategies: level-wise CP (L-CP), which calibrates each taxonomy level independently, and projection-based CP (P-CP), which calibrates only at the leaf level and projects the resulting set upward to coarser levels. The central claim is that both methods provide marginal coverage guarantees at every taxonomy level, with a trade-off: L-CP yields tighter but taxonomically inconsistent sets, while P-CP yields nested, consistent sets at the cost of larger coarse-level sets. The empirical evaluation uses a public 109,663-flow dataset with family/major/minor labels, sweeping α over 50 Monte Carlo splits. Results show that L-CP tracks nominal coverage and has a non-zero hierarchical inconsistency rate, while P-CP over-covers at coarse levels and has HIR=0 by construction. The paper argues P-CP is preferable for automated policy enforcement and L-CP for forensic triage.

Significance. If the claims hold, this is a useful application of established conformal-prediction ideas to a network-security problem where uncertainty quantification is genuinely needed. The paper includes a complete open-source implementation, 50-run Monte Carlo evaluation, and a clear operational discussion of set-valued predictions in hierarchical labeling. The two compared schemes are not new in themselves—L-CP and P-CP correspond to known hierarchical CP constructions, and the paper cites the relevant prior work—but the OS-fingerprinting domain, the HIR metric, and the systematic coverage-efficiency-consistency evaluation are useful contributions. The formal CP derivations are standard and, in the complete-hierarchy case, correct. The main impediments are a gap in the P-CP coverage proof for ragged hierarchies and an evaluation that relies on a single noisy-label dataset and lacks a flat-CP baseline.

major comments (3)

[§4.1 / §5.1] The empirical coverage numbers are all relative to HTTP User-Agent-derived labels, which the paper itself acknowledges 'may contain residual noise inherent to User-Agent parsing.' If these labels are wrong for some fraction of the data, the reported coverage is coverage of the noisy label, not necessarily of the true operating system. Since the paper's main applied claim is reliable OS fingerprinting, this label-quality issue is a threat to external validity. A sensitivity analysis, a comparison on a subset with independently verified labels, or at least a more prominent caveat that the guarantees are label-conditional would strengthen the paper. This does not invalidate the CP theory, but it does affect what the empirical evaluation supports.
[§5.1 / Table 2] The evaluation compares only L-CP and P-CP; there is no flat-CP baseline. The introduction motivates hierarchical CP by contrasting it with a direct application of CP to flat classification, but the paper never quantifies the efficiency or validity differences between either structured method and flat CP. Without that baseline, the claimed 'limitations' of flat CP and the operational advantage of the hierarchical framework are not empirically tested. This is a significant evaluation gap, although it does not undermine the internal L-CP/P-CP trade-off analysis.
[§4.3.2 / Eq. (10)] Equation (10) writes P{Y_k ∈ Γ_k | Y_k} ≥ 1−α, but the conditioning object 'Y_k' appears to be a typographical artifact. The standard split-CP guarantee is marginal over the test point and calibration data, not conditional on the label random variable. Please restate the equation as P(Y_k ∈ Γ_k(X)) ≥ 1−α (or with the appropriate subpopulation conditioning, depending on the intended meaning).

minor comments (4)

[§5.1 / Table 2] Table 2 reports coverage and set size only for the family and leaf levels, while the text says both methods were evaluated at all three levels and Figure 6 is said to show all levels. The major-version level should appear in the summary table, or its omission should be explained.
[§4.4 / §5.1] P-CP's HIR=0 is a logical consequence of Eq. (12)–(13), not an empirical finding. The paper correctly notes this 'by construction' in the implementation, but the Results section still presents HIR as a 'key differentiator.' It would be clearer to state that HIR=0 is a guaranteed property of P-CP, not a measured outcome.
[§4.3.4] The experimental implementation converts the ragged hierarchy into an effectively full-depth hierarchy by adding generic 'empty' leaf nodes. This choice should be more explicitly tied to the theoretical section: either the theory should be presented for full-depth hierarchies, or the implementation should be described as an approximation for the ragged case.
[§3.1 / §4.3.1] The notation for the ancestor map π_{k←leaf} is informal; the paper says 'whenever the level-k ancestor exists' but does not define the domain of π. Formalizing the map as a partial function would help avoid the ambiguity in Eq. (15).

Circularity Check

1 steps flagged · score 2.0 of 10

P-CP's HIR=0 is a definitional tautology (explicitly labeled 'by construction'), but it is not load-bearing; coverage, set-size, and L-CP's nonzero HIR are independent empirical findings.

self definitional [Section 4.3.4 / Eq. (12)-(13) / Section 4.4 Eq. (18)-(21) / Table 2]
"In the case of P-CP, the implementation strictly enforces consistency by deriving the upper-level sets solely from the valid leaf prediction set. Specifically, the major set is generated as the unique set of parents of all retained leaves, and the family set as the unique set of grandparents, ensuring HIR=0 by construction."

P-CP defines Γ^(B)_k (Eq. 12) as exactly the set of ancestors of retained leaves, and HIR (Eqs. 18-21) counts orphan/sterile violations of exactly that parent-child containment. Therefore HIR(P-CP)=0 follows from the method's definition; reporting it in Table 2 as a comparative differentiator is not an independent empirical result. The paper itself marks it 'by construction,' so this is a minor definitional tautology rather than a hidden circularity, and it does not affect the measured coverage or set-size comparisons.

full rationale

No significant circularity beyond the acknowledged definitional point. The two CP variants are applied to a held-out test partition (15% split, 50 Monte Carlo iterations) with calibration quantiles computed on a separate calibration set, so the reported marginal coverage and mean set sizes are genuine out-of-sample measurements, not fitted values renamed as predictions. L-CP's nonzero HIR is an empirical observation, as are P-CP's inflated coarse-level sets; the claimed efficiency-consistency trade-off therefore rests on independent evidence. Self-citations (Pérez-Jove et al., 2025 and related fingerprinting work) are background context, not load-bearing support for the coverage theorems. The separate concern raised about P-CP's coarse-level coverage in ragged hierarchies—marginal leaf coverage need not control coverage conditional on the level-k ancestor being defined—is a correctness/assumption gap in Eq. (15), not a circularity, and is not counted here.

Assumptions & free parameters 3 free parameters · 5 assumptions · 0 invented entities

No new entities are postulated. The paper relies on standard CP theory plus domain assumptions about label accuracy, exchangeability, and the OS taxonomy. The only tunable elements are the base MLP hyperparameters, which affect quantitative efficiency but not the distribution-free coverage guarantee.

free parameters (3)

Per-level MLP architecture = e.g., [64,32] family; [1024,512] leaf
Selected via random grid search on validation Macro F1; quantitative set sizes and coverage depend on these models.
Mutual-information feature count k
Hyperparameter chosen by grid search; not reported in text.
Class-weight / SMOTE settings
Used to counter imbalance; influences base-model scores and hence CP set sizes.

assumptions (5)

domain assumption Train/calibration/test data are exchangeable
Required for split-CP coverage guarantee; assumed in Section 4.3.4 stratified split.
domain assumption User-Agent-derived OS labels are accurate ground truth
Section 4.1; CP guarantees apply to these labels, not necessarily to true OS.
domain assumption The family→major→minor tree is the correct label hierarchy
Section 3.1; results are specific to this non-canonical taxonomy (Fig. 1).
standard math 1−softmax is a valid nonconformity score
CP accepts any score; this choice is standard (Angelopoulos & Bates 2023).
standard math Split CP marginal coverage theorem
Used in Eq. (3), (10), (15); cited to Angelopoulos & Bates.

how reviews work

0 comments

Cite this review

Pith. "Pith review of Reliable Hierarchical Operating System Fingerprinting via Conformal Prediction." pith.science (2026). https://pith.science/paper/YWT4CPG6

@misc{pith2026260212825,
  author       = {Pith},
  title        = {Pith review of: Reliable Hierarchical Operating System Fingerprinting via Conformal Prediction},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/YWT4CPG6}},
  note         = {Machine review of arXiv:2602.12825}
}

read the original abstract

Operating System (OS) fingerprinting is critical for network security, but conventional methods do not provide formal uncertainty quantification mechanisms. Conformal Prediction (CP) could be directly wrapped around existing methods to obtain prediction sets with guaranteed coverage. However, a direct application of CP would treat OS identification as a flat classification problem, ignoring the natural taxonomic structure of OSs and providing brittle point predictions. This work addresses these limitations by introducing and evaluating two distinct structured CP strategies: level-wise CP (L-CP), which calibrates each hierarchy level independently, and projection-based CP (P-CP), which ensures structural consistency by projecting leaf-level sets upwards. Our results demonstrate that, while both methods satisfy validity guarantees, they expose a fundamental trade-off between level-wise efficiency and structural consistency. L-CP yields tighter prediction sets suitable for human forensic analysis but suffers from taxonomic inconsistencies. Conversely, P-CP guarantees hierarchically consistent, nested sets ideal for automated policy enforcement, albeit at the cost of reduced efficiency at coarser levels.

Figures

Figures reproduced from arXiv: 2602.12825 by the authors.

**Figure 1.** Diagram of an illustrative example of hierarchical label tree in OS fingerprinting. This example adopts three levels— [PITH_FULL_IMAGE:figures/full_fig_p002_1.png] view at source ↗

**Figure 2.** Comparison of traditional OS fingerprinting and OS fingerprinting with Conformal Prediction (CP). The top section [PITH_FULL_IMAGE:figures/full_fig_p003_2.png] view at source ↗

**Figure 3.** Diagram illustrating the level-wise CP (L-CP) method for hierarchical OS fingerprinting. The system processes network traffic through feature engineering and applies separate MLP classifiers at each hierarchy level (family, major version, and minor version). Each classifier independently generates softmax outputs, which are then processed using Conformal Prediction to produce level-specific prediction sets. The figu… view at source ↗

Figures from the paper (7 more)

**Figure 4.** Figure 4: Diagram illustrating the projection-based CP (P-CP) method for hierarchical OS fingerprinting. The system applies CP only at the leaf (minor version) level, generating a prediction set based on the MLP classifier’s softmax outputs. The leaf-level prediction set is then…

**Figure 5.** Figure 5: Visual illustration of the two types of hierarchical violations that contribute to the Hierarchical Inconsistency Rate (HIR). [PITH_FULL_IMAGE:figures/full_fig_p010_5.png]

**Figure 6.** Figure 6: Empirical marginal coverage across hierarchy levels. The plot compares the coverage of L-CP and P-CP against the [PITH_FULL_IMAGE:figures/full_fig_p011_6.png]

**Figure 7.** Figure 7: Prediction efficiency measured by mean set size. The figure shows the average size of prediction sets for different α values [PITH_FULL_IMAGE:figures/full_fig_p011_7.png]

**Figure 8.** Figure 8: HIR comparison. The metric quantifies the frequency of taxonomic violations (e.g., orphan or sterile sets). [PITH_FULL_IMAGE:figures/full_fig_p011_8.png]

**Figure 9.** Figure 9: Frequency of empty prediction sets. The plot shows the rate at which methods abstain from prediction (return [PITH_FULL_IMAGE:figures/full_fig_p012_9.png]

**Figure 10.** Figure 10: Singleton rate (usability) comparison. This metric represents the proportion of samples where the prediction set contains [PITH_FULL_IMAGE:figures/full_fig_p012_10.png]

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

37 extracted references · 8 canonical work pages

[1]

write newline

" write newline "" before.all 'output.state := FUNCTION n.dashify 't := "" t empty not t #1 #1 substring "-" = t #1 #2 substring "--" = not "--" * t #2 global.max substring 't := t #1 #1 substring "-" = "-" * t #2 global.max substring 't := while if t #1 #1 substring * t #2 global.max substring 't := if while FUNCTION word.in bbl.in ":" * " " * FUNCTION f...
[2]

Accurate TLS Fingerprinting using Destination Context and Knowledge Bases

author Anderson, B. , & author McGrew , D. ( year 2020 ). title Accurate TLS fingerprinting using destination context and knowledge bases . :10.48550/arxiv.2009.01939

work page Pith review arXiv doi:10.48550/arxiv.2009.01939 2020
[3]

author Angelopoulos, A. N. , & author Bates, S. ( year 2023 ). title Conformal prediction: A gentle introduction . journal Foundations and Trends® in Machine Learning \/ , volume 16 \/ , pages 494--591 . :10.1561/2200000101

doi:10.1561/2200000101 2023
[4]

title FinisTerrae III User Guide - CESGA Technical Documentation

author CESGA ( year 2022 ). title FinisTerrae III User Guide - CESGA Technical Documentation . https://cesga-docs.gitlab.io/ft3-user-guide/index.html

2022
[5]

, author Zhang, Q

author Chang, D. , author Zhang, Q. , & author Li, X. ( year 2015 ). title Study on os fingerprinting and nat/tethering based on dns log analysis . In booktitle IRTF & ISOC Workshop on Research and Applications of Internet Measurements ( RAIM ) \/ (pp. pages 1--4 )

2015
[6]

, author Gou, G

author Fan, X. , author Gou, G. , author Kang, C. , author Shi, J. , & author Xiong, G. ( year 2019 ). title Identify OS from encrypted traffic with TCP / IP stack fingerprinting . In booktitle 2019 IEEE 38th International Performance Computing and Communications Conference ( IPCCC ) \/ (pp. pages 1--7 ). publisher IEEE . :10.1109/IPCCC47392.2019.8958772

arXiv 2019
[7]

author Hagos, D. H. , author Yazidi, A. , author Kure, O. , & author Engelstad, P. E. ( year 2021 ). title A machine-learning-based tool for passive OS fingerprinting with TCP variant as a novel feature . journal IEEE Internet of Things Journal \/ , volume 8 \/ , pages 3534--3553 . :10.1109/JIOT.2020.3024293

arXiv 2021
[8]

, author Bartoš, V

author Hulák, M. , author Bartoš, V. , & author Čejka, T. ( year 2023 ). title Evaluation of passive OS fingerprinting methods using TCP / IP fields . In booktitle 2023 8th International Conference on Smart and Sustainable Technologies, SpliTech 2023 \/ . publisher IEEE . :10.23919/SpliTech58164.2023.10192974

arXiv 2023

Show all 37 references

[9]

, author Čermák, M

author Husák, M. , author Čermák, M. , author Jirsík, T. , & author Čeleda, P. ( year 2016 ). title HTTPS traffic analysis and client identification using passive SSL / TLS fingerprinting . journal EURASIP Journal on Information Security \/ , volume 2016 \/ , pages 6 . :10.118...

2016 doi
[10]

, author Barford, P

author Kline, J. , author Barford, P. , author Cahn, A. , & author Sommers, J. ( year 2017 ). title On the structure and characteristics of user agent string . In booktitle Proceedings of the 2017 Internet Measurement Conference \/ (pp. pages 184--190 ). publisher ACM . :10.11...

2017
[11]

, author Jirsik, T

author Lastovicka, M. , author Jirsik, T. , author Celeda, P. , author Spacek, S. , & author Filakovsky, D. ( year 2018 ). title Passive os fingerprinting methods in the jungle of wireless networks . In booktitle NOMS 2018 - 2018 IEEE / IFIP Network Operations and Management S...

2018
[12]

, author Dufka, A

author Laštovička, M. , author Dufka, A. , & author Komárková, J. ( year 2018 ). title Machine learning fingerprinting methods in cyber security domain: Which one to use? In booktitle 2018 14th International Wireless Communications & Mobile Computing Conference ( IWCMC ) \/ (p...

2018
[13]

, & author Filakovsky, D

author Laštovička, M. , & author Filakovsky, D. ( year 2018 ). title Passive os fingerprinting prototype demonstration . In booktitle NOMS 2018 - 2018 IEEE / IFIP Network Operations and Management Symposium \/ (pp. pages 1--2 ). :10.1109/NOMS.2018.8406128

2018
[14]

, author Husák, M

author Laštovička, M. , author Husák, M. , author Velan, P. , author Jirsík, T. , & author Čeleda, P. ( year 2023 a ). title Dataset - passive operating system fingerprinting revisited - network flows dataset . :10.5281/ZENODO.7635138

2023 doi
[15]

, author Husák, M

author Laštovička, M. , author Husák, M. , author Velan, P. , author Jirsík, T. , & author Čeleda, P. ( year 2023 b ). title Passive operating system fingerprinting revisited: Evaluation and current challenges . journal Computer Networks \/ , (p. pages 109782 ). :10.1016/j.com...

2023
[16]

, author Špaček, S

author Laštovička, M. , author Špaček, S. , author Velan, P. , & author Čeleda, P. ( year 2020 ). title Using TLS fingerprints for OS identification in encrypted traffic . In booktitle NOMS 2020 - 2020 IEEE / IFIP Network Operations and Management Symposium \/ (pp. pages 1--6 ...

2020
[17]

, author Wei, Z

author Li, J. , author Wei, Z. , & author Chen, S. ( year 2023 ). title Passive OS identification in imbalanced dataset . In booktitle 2023 International Conference on Electrical, Computer and Energy Technologies ( ICECET ) \/ (pp. pages 1--6 ). :10.1109/ICECET58911.2023.10389569

2023
[18]

( year 2020 )

author Li, R. ( year 2020 ). title Overview: Fingerprinting services on the internet . journal Network \/ , . :10.2313/NET-2020-11-1_14

2020 doi
[19]

author Lyon, G. F. ( year 2009 ). title Nmap Network Scanning: The Official Nmap Project Guide to Network Discovery and Security Scanning \/ . publisher Insecure.Com LLC . https://nmap.org/book/

2009
[20]

, author Rysavý, O

author Matousek, P. , author Rysavý, O. , author Grégr, M. , & author Vymlátil, M. ( year 2014 ). title Towards identification of operating systems from the internet traffic - ipfix monitoring with fingerprinting and clustering. In booktitle DCNET \/ (pp. pages 21--27 ). https...

2014 doi
[21]

, author Javanmardi, A

author Mortier, T. , author Javanmardi, A. , author Sale, Y. , author Hüllermeier, E. , & author Waegeman, W. ( year 2025 ). title Conformal prediction in hierarchical classification . :10.48550/arXiv.2501.19038. arXiv:2501.19038 [stat] http://arxiv.org/abs/2501.19038 [stat]

2025 doi arXiv
[22]

title NetworkMiner - the NSM and network forensics analysis tool

author Netresec ( year 2022 ). title NetworkMiner - the NSM and network forensics analysis tool . https://www.netresec.com/?page=NetworkMiner

2022
[23]

title Ettercap project

author Ornaghi, Alberto , author Valleri, Marco , author Escobar, Emilio , author Costamagna, Gianfranco , author Koeppe, Alexander , & author Abdulkadir, Ali ( year 2001 ). title Ettercap project

2001
[24]

, author Georgiou, N

author Papadopoulos, H. , author Georgiou, N. , author Eliades, C. , & author Konstantinidis, A. ( year 2018 ). title Android malware detection with unbiased confidence guarantees . journal Neurocomputing \/ , volume 280 \/ , pages 3--12 . :10.1016/j.neucom.2017.08.072

2018 doi
[25]

, author Munteanu, C

author P \'e rez-Jove , R. , author Munteanu, C. R. , author Pazos, A. , & author V \'a zquez-Naya , J. ( year 2025 ). title Application of Tabular Transformer Architectures for Operating System Fingerprinting . :10.48550/arXiv.2502.09084. arXiv:2502.09084 http://arxiv.org/abs...

2025 doi arXiv
[26]

( year 1981 a )

author Postel, J. ( year 1981 a ). title Internet protocol . https://www.rfc-editor.org/rfc/rfc791

1981
[27]

( year 1981 b )

author Postel, J. ( year 1981 b ). title Transmission control protocol . https://www.rfc-editor.org/rfc/rfc793

1981
[28]

, author Munteanu, C

author Pérez-Jove, R. , author Munteanu, C. R. , author Dorado, J. , author Pazos, A. , & author Vázquez-Naya, J. ( a ). title Network traffic foundation models: A systematic review . journal Computer Networks \/ , volume 276 \/ , pages 111998 . :10.1016/j.comnet.2026.111998

2026
[29]

, author Munteanu, C

author Pérez-Jove, R. , author Munteanu, C. R. , author Dorado, J. , author Pazos, A. , & author Vázquez-Naya, J. ( b ). title Operating System Fingerprinting Tool Based on Classical Machine Learning Algorithms . In booktitle 2023 JNIC Cybersecurity Conference ( JNIC ) \/ (pp....

2023
[30]

, author Cline, D

author Shamsi, Z. , author Cline, D. B. H. , & author Loguinov, D. ( year 2021 ). title Faulds: A non-parametric iterative classifier for internet-wide OS fingerprinting . journal IEEE / ACM Transactions on Networking \/ , volume 29 \/ , pages 2339--2352 . :10.1109/TNET.2021.3088333

2021
[31]

, author Courtay, O

author Veysset, F. , author Courtay, O. , & author Heen, O. ( year 2002 ). title New tool and technique for remote operating system fingerprinting . journal Intranode Software Technologies \/ , (p. pages 13 )

2002
[32]

, & author Gnezdilov, K

author Voronov, I. , & author Gnezdilov, K. ( year 2021 ). title Determining OS and applications by DNS traffic analysis . In booktitle 2021 IEEE Conference of Russian Young Researchers in Electrical and Electronic Engineering ( ElConRus ) \/ (pp. pages 72--76 ). :10.1109/ElCo...

2021
[33]

, author Lindsay, D

author Vovk, V. , author Lindsay, D. , author Nouretdinov, I. , & author Gammerman, A. ( year 2003 ). title Mondrian Confidence Machine \/ . type Technical Report Royal Holloway, University of London

2003
[34]

, author Issac, B

author Yumlembam, R. , author Issac, B. , author Jacob, S. M. , & author Yang, L. ( year 2024 ). title Comprehensive botnet detection by mitigating adversarial attacks, navigating the subtleties of perturbation distances and fortifying predictions with conformal layers . journ...

2024
[35]

( year 2005 )

author Zalewski, M. ( year 2005 ). title p0f v2: Passive OS fingerprinting tool . https://lcamtuf.coredump.cx/p0f.shtml

2005
[36]

, author Li, S

author Zhang, B. , author Li, S. , & author Bastani, O. ( year 2024 ). title Conformal structured prediction . journal International Conference on Learning Representations \/ , . https://doi.org/10.48550/arxiv.2410.06296. :10.48550/arxiv.2410.06296

2024 doi arXiv
[37]

write newline

" write newline "" before.all 'output.state := FUNCTION n.dashify 't := "" t empty not t #1 #1 substring "-" = t #1 #2 substring "--" = not "--" * t #2 global.max substring 't := t #1 #1 substring "-" = "-" * t #2 global.max substring 't := while if t #1 #1 substring * t #2 gl...

Pith tools

Reviewed August 2, 2026 · model on record in the stance chip above.

[1] [1]

write newline

" write newline "" before.all 'output.state := FUNCTION n.dashify 't := "" t empty not t #1 #1 substring "-" = t #1 #2 substring "--" = not "--" * t #2 global.max substring 't := t #1 #1 substring "-" = "-" * t #2 global.max substring 't := while if t #1 #1 substring * t #2 global.max substring 't := if while FUNCTION word.in bbl.in ":" * " " * FUNCTION f...

[2] [2]

Accurate TLS Fingerprinting using Destination Context and Knowledge Bases

author Anderson, B. , & author McGrew , D. ( year 2020 ). title Accurate TLS fingerprinting using destination context and knowledge bases . :10.48550/arxiv.2009.01939

work page Pith review arXiv doi:10.48550/arxiv.2009.01939 2020

[3] [3]

author Angelopoulos, A. N. , & author Bates, S. ( year 2023 ). title Conformal prediction: A gentle introduction . journal Foundations and Trends® in Machine Learning \/ , volume 16 \/ , pages 494--591 . :10.1561/2200000101

doi:10.1561/2200000101 2023

[4] [4]

title FinisTerrae III User Guide - CESGA Technical Documentation

author CESGA ( year 2022 ). title FinisTerrae III User Guide - CESGA Technical Documentation . https://cesga-docs.gitlab.io/ft3-user-guide/index.html

2022

[5] [5]

, author Zhang, Q

author Chang, D. , author Zhang, Q. , & author Li, X. ( year 2015 ). title Study on os fingerprinting and nat/tethering based on dns log analysis . In booktitle IRTF & ISOC Workshop on Research and Applications of Internet Measurements ( RAIM ) \/ (pp. pages 1--4 )

2015

[6] [6]

, author Gou, G

author Fan, X. , author Gou, G. , author Kang, C. , author Shi, J. , & author Xiong, G. ( year 2019 ). title Identify OS from encrypted traffic with TCP / IP stack fingerprinting . In booktitle 2019 IEEE 38th International Performance Computing and Communications Conference ( IPCCC ) \/ (pp. pages 1--7 ). publisher IEEE . :10.1109/IPCCC47392.2019.8958772

arXiv 2019

[7] [7]

author Hagos, D. H. , author Yazidi, A. , author Kure, O. , & author Engelstad, P. E. ( year 2021 ). title A machine-learning-based tool for passive OS fingerprinting with TCP variant as a novel feature . journal IEEE Internet of Things Journal \/ , volume 8 \/ , pages 3534--3553 . :10.1109/JIOT.2020.3024293

arXiv 2021

[8] [8]

, author Bartoš, V

author Hulák, M. , author Bartoš, V. , & author Čejka, T. ( year 2023 ). title Evaluation of passive OS fingerprinting methods using TCP / IP fields . In booktitle 2023 8th International Conference on Smart and Sustainable Technologies, SpliTech 2023 \/ . publisher IEEE . :10.23919/SpliTech58164.2023.10192974

arXiv 2023