ICMP Probe Fingerprinting for Remote Computer Attribute Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for determining attributes of remote computers, such as operating systems, often face challenges due to attackers concealing information to evade detection, making it difficult for administrators to assess vulnerabilities and unauthorized devices within networks.
Innovation Solution
A system that uses ICMP queries with varying configurations to probe remote computers, analyzing responses to construct a 'fingerprint' that identifies attributes, including operating systems, by setting and resetting specific packet options and evaluating responses to determine consistent and inconsistent settings, thereby identifying the target computer's attributes.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Difficulty of detecting and measuring
If attackers conceal information about their systems, then detection difficulty increases, but information accuracy deteriorates
Solution Approach 1:
The system dynamically adapts its probing strategy by analyzing responses from initial scans and adjusting subsequent probe types, configurations, and targets. The scanning process evolves from broad port scanning to targeted OS fingerprinting based on discovered services and response patterns, allowing the system to overcome concealment tactics while maintaining accurate information gathering.
Solution Approach 2:
The system changes multiple parameters of ICMP probes including TTL values, IP identification numbers, packet sizes, and payload content to create unique fingerprint patterns. By varying these parameters and analyzing how target systems respond differently to each variation, the system can accurately identify operating systems even when attackers attempt to conceal their identity through standard anti-detection measures.
2Measurement precision
If multiple probes are sent to determine computer attributes, then detection accuracy improves, but time consumption increases
Solution Approach 1:
The system performs preliminary port scanning and service identification before conducting detailed OS fingerprinting. By first determining which ports are open and what services are running, the system can then target its fingerprinting probes more precisely, reducing the total number of probes needed while maintaining high detection accuracy.
Solution Approach 2:
The scanning process is divided into distinct phases: initial port discovery, service identification, and targeted OS fingerprinting. Each phase uses different probe types and strategies, allowing the system to gather information efficiently in stages rather than using a single time-consuming comprehensive scan approach.
Data Source
AI summary
Determining an attribute of a target computer is disclosed. A first ICMP query is set to a first state. A second ICMP query is set to a second state. The first and second ICMP queries are sent to the target computer. Responses associated with the first and second ICMP queries that are received from the target computer are combined. An attribute of the target computer is determined based on the combination of the responses.