An operating system identification method based on random forest

Abstract

The invention discloses an operating system identification method based on a random forest, which adopts a Monte Carlo method to randomly sample a fingerprint library to form a training set and a test set, and then performs vectorization processing; and uses a binning method to perform data passivation processing; Based on the set layered architecture, according to the operating system category identification layer, operating system major version number identification layer and operating system detailed version identification layer, train random forest classifiers respectively, build multiple decision trees, each tree uses its own out-of-package estimation If the test accuracy is higher than the set accuracy threshold, it will be added to the random forest; local incremental training of layered architecture, parameter adjustment processing to improve model accuracy; identification and prediction of real detection traffic, each tree in the random forest Both give a classification result, adopt the equal voting method, and select the category with the most votes as the final prediction result. It can effectively identify unknown fingerprints and improve the accuracy of identification.

Description

technical field [0001] The invention belongs to the technical field of computers, and in particular relates to an operating system identification method based on a random forest. Background technique [0002] With the rapid popularization of the Internet, the importance of the network security field has become increasingly prominent. The detection and identification of the operating system is of great significance to the assessment and protection of network security, and it is also an important step in asset identification. [0003] At present, most of the detection tools are mainly based on the known operating system fingerprint library, using the traditional static fingerprint matching method to judge, there is a problem of difficulty in identifying unknown fingerprints, and the introduction of machine learning related algorithms to further mine the sufficient and necessary conditions for fingerprints from features , can effectively solve the problem of unknown fingerprint...

AI Technical Summary

Problems solved by technology

Zou Tiezheng proposed an operating system identification method based on support vector machines, which is classified by constructing a large number of binary classifiers. However, this method has limitations. With the increase of operating system types, the training overhead of the support vector machine method is too large, and the application performance suffers. bottleneck

Images