Operating System Identification via Multi-Test Conflict Resolution

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Conventional operating system identification systems are limited by invasive tests that can crash nodes, reliance on single or dual identification methods, and lack of conflict resolution mechanisms, resulting in safety and accuracy issues.

Innovation Solution

An automated system employing multiple non-invasive tests, such as TCP, ICMP, banner matching, open port signature, and NULL session enumeration tests, with a logic engine and conflict resolution module to generate accurate and reliable operating system identifications by comparing results with stored fingerprints and resolving conflicts.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Measurement precision

If invasive tests are used to identify operating systems, then identification accuracy may be improved, but node stability deteriorates (nodes may crash or be harmed)

Engineering Contradiction:

Improveoperating system identification accuracyVSAvoidnode crash or harm

Core Design Contradiction:

Measurement precisionVSObject-affected harmful factors

Solution Approach 1:

The identification process is segmented into multiple independent non-invasive tests (TCP tests, ICMP tests, banner matching, open port signature tests, NULL session enumeration tests) that collectively provide accurate identification without harming the node. Each test segment contributes specific identification data without the harmful effects of invasive testing.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The testing approach changes from invasive to non-invasive by modifying test parameters and methods. Instead of using tests that can crash nodes, the system uses non-invasive variants that gather sufficient identification information while maintaining node stability, fundamentally changing the nature of the interaction with the tested system.

Inventive Principle:

Principle #35Parameter changes

2Measurement precision

If multiple identification tests are combined, then identification accuracy is improved, but system complexity increases

Engineering Contradiction:

Improveoperating system identification accuracyVSAvoididentification system complexity

Core Design Contradiction:

Measurement precisionVSDevice complexity

Solution Approach 1:

The system uses feedback mechanisms where test results are continuously evaluated and used to determine subsequent actions. The identification module analyzes results from multiple tests, compares them against stored fingerprints, and adjusts the identification process accordingly, resolving conflicts between competing test results through structured feedback loops.

Inventive Principle:

Principle #23Feedback

Solution Approach 2:

The identification module serves multiple functions: it coordinates multiple different tests, processes their results, compares against various fingerprints, resolves conflicts between tests, and produces the final identification. This multi-functional approach manages complexity by having a single intelligent component handle diverse identification tasks.

Inventive Principle:

Principle #6Universality (Multi-functionality)

3Device complexity

If only one or two identification tests are used, then system complexity is reduced, but identification accuracy deteriorates

Engineering Contradiction:

Improveidentification system complexityVSAvoidoperating system identification accuracy

Core Design Contradiction:

Device complexityVSMeasurement precision

Solution Approach 1:

The system merges multiple different identification tests (TCP, ICMP, banner matching, open port signatures, NULL session enumeration) into a unified identification process. By combining these diverse tests, the system achieves comprehensive and accurate operating system identification that overcomes the limitations of using only one or two tests.

Inventive Principle:

Principle #5Merging (Combining)

4Device complexity

If no conflict resolution mechanism is implemented, then system complexity is reduced, but identification reliability deteriorates (competing test results cannot be resolved)

Engineering Contradiction:

Improvesystem complexityVSAvoididentification reliability

Core Design Contradiction:

Device complexityVSReliability

Solution Approach 1:

The identification module acts as an intermediary that mediates between competing test results. It receives results from multiple independent tests, compares them against stored fingerprints, and resolves conflicts by determining which test results are most reliable and consistent with known operating system characteristics, thereby ensuring reliable identification despite test conflicts.

Inventive Principle:

Principle #24Intermediary (Mediator)

Data Source

PatentUS7519954B1System and method of operating system identification

Publication Date: 2009.04.14 MCAFEE LLC

AI summary

An automated system performs multiple tests for identifying an operating system executed by a network node. A combination of multiple tests may be calibrated to generate an acceptably accurate operating system identification. An identification module makes an overall identification based on identifications of the tests. A plurality of identification rules may determine which of the individual tests is likely to be most accurate. The system also may include a conflict resolution module that resolves conflicts among the multiple tests. The conflict resolution module may employ a plurality of conflict resolution definitions that define special cases in which the general identification rules may be overridden to make an identification without regard to the general identification rules. Alternatively, the conflict resolution module may be configured to work in combination with the general identification rules to make an operating system identification.