{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2025,6,19]],"date-time":"2025-06-19T04:13:31Z","timestamp":1750306411743,"version":"3.41.0"},"publisher-location":"New York, NY, USA","reference-count":38,"publisher":"ACM","license":[{"start":{"date-parts":[[2015,10,16]],"date-time":"2015-10-16T00:00:00Z","timestamp":1444953600000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.acm.org\/publications\/policies\/copyright_policy#Background"}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":[],"published-print":{"date-parts":[[2015,10,16]]},"DOI":"10.1145\/2808769.2808777","type":"proceedings-article","created":{"date-parts":[[2015,10,6]],"date-time":"2015-10-06T15:22:12Z","timestamp":1444144932000},"page":"57-67","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":4,"title":["Remote Operating System Classification over IPv6"],"prefix":"10.1145","author":[{"given":"David","family":"Fifield","sequence":"first","affiliation":[{"name":"University of California, Berkeley, Berkeley, CA, USA"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Alexandru","family":"Geana","sequence":"additional","affiliation":[{"name":"Technische Universiteit Eindhoven \/ Fox-IT, Delft, Eindhoven, Netherlands"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Luis","family":"MartinGarcia","sequence":"additional","affiliation":[{"name":"ETSIT, Polytechnic University of Madrid, Madrid, Spain"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Mathias","family":"Morbitzer","sequence":"additional","affiliation":[{"name":"Fox-IT, Delft, Delft, Netherlands"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"J.D.","family":"Tygar","sequence":"additional","affiliation":[{"name":"University of California, Berkeley, Berkeley, CA, USA"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"320","published-online":{"date-parts":[[2015,10,16]]},"reference":[{"key":"e_1_3_2_1_1_1","volume-title":"Aug.","author":"Arkin O.","year":"2002","unstructured":"O. Arkin and F. Yarochkin . Xprobe v2.0: A \"fuzzy\" approach to remote active operating system fingerprinting. Technical report , Aug. 2002 . http:\/\/www.ouah.org\/Xprobe2.pdf. O. Arkin and F. Yarochkin. Xprobe v2.0: A \"fuzzy\" approach to remote active operating system fingerprinting. Technical report, Aug. 2002. http:\/\/www.ouah.org\/Xprobe2.pdf."},{"key":"e_1_3_2_1_2_1","volume-title":"Nov.","author":"Atlas A.","year":"2014","unstructured":"A. Atlas . MLD considered harmful? , Nov. 2014 . http:\/\/www.insinuator.net\/2014\/11\/mld-considered-harmful\/. A. Atlas. MLD considered harmful?, Nov. 2014. http:\/\/www.insinuator.net\/2014\/11\/mld-considered-harmful\/."},{"key":"e_1_3_2_1_3_1","doi-asserted-by":"publisher","DOI":"10.1007\/s11416-008-0107-z"},{"key":"e_1_3_2_1_4_1","volume-title":"Multiple imputation by chained equations: what is it and how does it work? International journal of methods in psychiatric research, 20(1):40--49","author":"Azur M. J.","year":"2011","unstructured":"M. J. Azur , E. A. Stuart , C. Frangakis , and P. J. Leaf . Multiple imputation by chained equations: what is it and how does it work? International journal of methods in psychiatric research, 20(1):40--49 , 2011 . M. J. Azur, E. A. Stuart, C. Frangakis, and P. J. Leaf. Multiple imputation by chained equations: what is it and how does it work? International journal of methods in psychiatric research, 20(1):40--49, 2011."},{"key":"e_1_3_2_1_5_1","volume-title":"June","author":"Beardsley T.","year":"2003","unstructured":"T. Beardsley . Snacktime: A Perl solution for remote OS fingerprinting , June 2003 . http:\/\/www.planb-security.net\/wp\/snacktime.html. T. Beardsley. Snacktime: A Perl solution for remote OS fingerprinting, June 2003. http:\/\/www.planb-security.net\/wp\/snacktime.html."},{"key":"e_1_3_2_1_6_1","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"crossref","first-page":"158","DOI":"10.1007\/978-3-540-24668-8_16","volume-title":"Passive and Active Network Measurement","author":"Beverly R.","year":"2004","unstructured":"R. Beverly . A robust classifier for passive TCP\/IP fingerprinting . In C. Barakat and I. Pratt, editors, Passive and Active Network Measurement , volume 3015 of Lecture Notes in Computer Science , pages 158 -- 167 . Springer Berlin Heidelberg , 2004 . https:\/\/www.cl.cam.ac.uk\/research\/srg\/netos\/pam2004\/papers\/260.pdf. R. Beverly. A robust classifier for passive TCP\/IP fingerprinting. In C. Barakat and I. Pratt, editors, Passive and Active Network Measurement, volume 3015 of Lecture Notes in Computer Science, pages 158--167. Springer Berlin Heidelberg, 2004. https:\/\/www.cl.cam.ac.uk\/research\/srg\/netos\/pam2004\/papers\/260.pdf."},{"key":"e_1_3_2_1_7_1","volume-title":"mice: Multivariate imputation by chained equations in R. Journal of statistical software, 45(3)","author":"Buuren S.","year":"2011","unstructured":"S. Buuren and K. Groothuis-Oudshoorn . mice: Multivariate imputation by chained equations in R. Journal of statistical software, 45(3) , 2011 . http:\/\/www.jstatsoft.org\/v45\/i03\/paper. S. Buuren and K. Groothuis-Oudshoorn. mice: Multivariate imputation by chained equations in R. Journal of statistical software, 45(3), 2011. http:\/\/www.jstatsoft.org\/v45\/i03\/paper."},{"key":"e_1_3_2_1_8_1","volume-title":"RFC Editor","author":"Conta A.","year":"2006","unstructured":"A. Conta , S. Deering , and M. Gupta . Internet Control Message Protocol (ICMPv6) for the Internet Protocol Version 6 (IPv6) specification. RFC 4443 , RFC Editor , Mar. 2006 . https:\/\/tools.ietf.org\/html\/rfc4443. A. Conta, S. Deering, and M. Gupta. Internet Control Message Protocol (ICMPv6) for the Internet Protocol Version 6 (IPv6) specification. RFC 4443, RFC Editor, Mar. 2006. https:\/\/tools.ietf.org\/html\/rfc4443."},{"key":"e_1_3_2_1_9_1","volume-title":"July","author":"Corbet J.","year":"2004","unstructured":"J. Corbet . TCP window scaling and broken routers , July 2004 . https:\/\/lwn.net\/Articles\/92727\/. J. Corbet. TCP window scaling and broken routers, July 2004. https:\/\/lwn.net\/Articles\/92727\/."},{"key":"e_1_3_2_1_10_1","unstructured":"J. Corbet. Increasing the TCP initial congestion window Feb. 2011. https:\/\/lwn.net\/Articles\/427104\/.  J. Corbet. Increasing the TCP initial congestion window Feb. 2011. https:\/\/lwn.net\/Articles\/427104\/."},{"key":"e_1_3_2_1_11_1","volume-title":"RFC Editor","author":"Crawford M.","year":"2006","unstructured":"M. Crawford and B. Haberman . IPv6 Node Information queries. RFC 4620 , RFC Editor , Aug. 2006 . https:\/\/tools.ietf.org\/html\/rfc4620. M. Crawford and B. Haberman. IPv6 Node Information queries. RFC 4620, RFC Editor, Aug. 2006. https:\/\/tools.ietf.org\/html\/rfc4620."},{"key":"e_1_3_2_1_12_1","volume-title":"RFC Editor","author":"Deering S. E.","year":"1998","unstructured":"S. E. Deering and R. M. Hinden . Internet Protocol, version 6 (IPv6) specification. RFC 2460 , RFC Editor , Dec. 1998 . https:\/\/tools.ietf.org\/html\/rfc2460. S. E. Deering and R. M. Hinden. Internet Protocol, version 6 (IPv6) specification. RFC 2460, RFC Editor, Dec. 1998. https:\/\/tools.ietf.org\/html\/rfc2460."},{"key":"e_1_3_2_1_13_1","volume-title":"Oct.","author":"Edge J.","year":"2008","unstructured":"J. Edge . Networking change causes distribution headaches , Oct. 2008 . https:\/\/lwn.net\/Articles\/304791\/. J. Edge. Networking change causes distribution headaches, Oct. 2008. https:\/\/lwn.net\/Articles\/304791\/."},{"key":"e_1_3_2_1_14_1","doi-asserted-by":"publisher","DOI":"10.5555\/1390681.1442794"},{"key":"e_1_3_2_1_15_1","volume-title":"RFC Editor","author":"Gont F.","year":"2013","unstructured":"F. Gont . Processing of IPv6 \"atomic\" fragments. RFC 6946 , RFC Editor , May 2013 . https:\/\/tools.ietf.org\/html\/rfc6946. F. Gont. Processing of IPv6 \"atomic\" fragments. RFC 6946, RFC Editor, May 2013. https:\/\/tools.ietf.org\/html\/rfc6946."},{"key":"e_1_3_2_1_16_1","doi-asserted-by":"publisher","DOI":"10.5555\/1323276.1323282"},{"key":"e_1_3_2_1_17_1","volume-title":"RFC Editor","author":"Jacobson V.","year":"1992","unstructured":"V. Jacobson , B. Braden , and D. Borman . TCP extensions for high performance. RFC 1323 , RFC Editor , May 1992 . https:\/\/tools.ietf.org\/html\/rfc1323. V. Jacobson, B. Braden, and D. Borman. TCP extensions for high performance. RFC 1323, RFC Editor, May 1992. https:\/\/tools.ietf.org\/html\/rfc1323."},{"key":"e_1_3_2_1_18_1","volume-title":"Oct.","author":"Lyon G.","year":"1998","unstructured":"G. Lyon . Remote OS detection via TCP\/IP stack fingerprinting. Phrack, 8(54) , Oct. 1998 . https:\/\/nmap.org\/nmap-fingerprinting-old.html. G. Lyon. Remote OS detection via TCP\/IP stack fingerprinting. Phrack, 8(54), Oct. 1998. https:\/\/nmap.org\/nmap-fingerprinting-old.html."},{"key":"e_1_3_2_1_19_1","volume-title":"Nmap Network Scanning","author":"Lyon G.","year":"2009","unstructured":"G. Lyon . Nmap Network Scanning , chapter Remote OS Detection. 2009 . https:\/\/nmap.org\/book\/osdetect.html. G. Lyon. Nmap Network Scanning, chapter Remote OS Detection. 2009. https:\/\/nmap.org\/book\/osdetect.html."},{"issue":"1","key":"e_1_3_2_1_20_1","first-page":"49","article-title":"On the generalised distance in statistics","volume":"2","author":"Mahalanobis P. C.","year":"1936","unstructured":"P. C. Mahalanobis . On the generalised distance in statistics . Proceedings of the National Institute of Sciences of India , 2 ( 1 ): 49 -- 55 , 1936 . P. C. Mahalanobis. On the generalised distance in statistics. Proceedings of the National Institute of Sciences of India, 2(1):49--55, 1936.","journal-title":"Proceedings of the National Institute of Sciences of India"},{"key":"e_1_3_2_1_21_1","volume-title":"June","author":"MartinGarcia L.","year":"2011","unstructured":"L. MartinGarcia . {tool} fpanaly.py : IPv6 OS detection test result analysis tool , June 2011 . https:\/\/svn.nmap.org\/nmap-exp\/luis\/ipv6tests\/fpanaly.py?p=34606. L. MartinGarcia. {tool} fpanaly.py: IPv6 OS detection test result analysis tool, June 2011. https:\/\/svn.nmap.org\/nmap-exp\/luis\/ipv6tests\/fpanaly.py?p=34606."},{"key":"e_1_3_2_1_22_1","volume-title":"June","author":"MartinGarcia L.","year":"2011","unstructured":"L. MartinGarcia . {tool} ipv6fp.py : IPv6 OS detection test suite , June 2011 . https:\/\/svn.nmap.org\/nmap-exp\/luis\/ipv6tests\/ipv6fp.py?p=34606. L. MartinGarcia. {tool} ipv6fp.py: IPv6 OS detection test suite, June 2011. https:\/\/svn.nmap.org\/nmap-exp\/luis\/ipv6tests\/ipv6fp.py?p=34606."},{"key":"e_1_3_2_1_23_1","doi-asserted-by":"publisher","DOI":"10.1109\/EFTA.2007.4416854"},{"key":"e_1_3_2_1_24_1","volume-title":"TCP idle scans in IPv6. Master's thesis","author":"Morbitzer M.","year":"2013","unstructured":"M. Morbitzer . TCP idle scans in IPv6. Master's thesis , Radboud University Nijmegen , Aug. 2013 . https:\/\/www.ru.nl\/publish\/pages\/578936\/m_morbitzer_masterthesis.pdf. M. Morbitzer. TCP idle scans in IPv6. Master's thesis, Radboud University Nijmegen, Aug. 2013. https:\/\/www.ru.nl\/publish\/pages\/578936\/m_morbitzer_masterthesis.pdf."},{"key":"e_1_3_2_1_25_1","volume-title":"RFC Editor","author":"Narten T.","year":"2007","unstructured":"T. Narten , E. Nordmark , W. Simpson , and H. Soliman . Neighbor discovery for IP version 6 (IPv6). RFC 4861 , RFC Editor , Sept. 2007 . https:\/\/tools.ietf.org\/html\/rfc4861. T. Narten, E. Nordmark, W. Simpson, and H. Soliman. Neighbor discovery for IP version 6 (IPv6). RFC 4861, RFC Editor, Sept. 2007. https:\/\/tools.ietf.org\/html\/rfc4861."},{"key":"e_1_3_2_1_26_1","unstructured":"National Institute of Standards and Technology. Common Platform Enumeration (CPE). https:\/\/nvd.nist.gov\/cpe.cfm.  National Institute of Standards and Technology. Common Platform Enumeration (CPE). https:\/\/nvd.nist.gov\/cpe.cfm."},{"key":"e_1_3_2_1_27_1","doi-asserted-by":"publisher","DOI":"10.5555\/1953048.2078195"},{"key":"e_1_3_2_1_28_1","volume-title":"RFC Editor","author":"Ramakrishnan K.","year":"2001","unstructured":"K. Ramakrishnan , S. Floyd , and D. Black . The addition of explicit congestion notification (ECN) to IP. RFC 3168 , RFC Editor , Sept. 2001 . https:\/\/tools.ietf.org\/html\/rfc3168. K. Ramakrishnan, S. Floyd, and D. Black. The addition of explicit congestion notification (ECN) to IP. RFC 3168, RFC Editor, Sept. 2001. https:\/\/tools.ietf.org\/html\/rfc3168."},{"key":"e_1_3_2_1_29_1","doi-asserted-by":"publisher","DOI":"10.1145\/1866423.1866430"},{"issue":"1","key":"e_1_3_2_1_30_1","first-page":"35","article-title":"Using neural networks to improve classical operating system fingerprinting techniques","volume":"8","author":"Sarraute C.","year":"2008","unstructured":"C. Sarraute and J. Burroni . Using neural networks to improve classical operating system fingerprinting techniques . Electronic Journal of SADIO , 8 ( 1 ): 35 -- 47 , 2008 . http:\/\/www.coresecurity.com\/files\/attachments\/Sarraute_EJS.pdf. C. Sarraute and J. Burroni. Using neural networks to improve classical operating system fingerprinting techniques. Electronic Journal of SADIO, 8(1):35--47, 2008. http:\/\/www.coresecurity.com\/files\/attachments\/Sarraute_EJS.pdf.","journal-title":"Electronic Journal of SADIO"},{"key":"e_1_3_2_1_31_1","doi-asserted-by":"publisher","DOI":"10.1145\/2591971.2591972"},{"key":"e_1_3_2_1_32_1","volume-title":"9th USENIX Security Symposium","author":"Smart M.","year":"2000","unstructured":"M. Smart , G. R. Malan , and F. Jahanian . Defeating TCP\/IP stack fingerprinting . In 9th USENIX Security Symposium , Aug. 2000 . https:\/\/www.usenix.org\/legacy\/publications\/library\/proceedings\/sec2000\/full_papers\/smart\/smart.pdf. M. Smart, G. R. Malan, and F. Jahanian. Defeating TCP\/IP stack fingerprinting. In 9th USENIX Security Symposium, Aug. 2000. https:\/\/www.usenix.org\/legacy\/publications\/library\/proceedings\/sec2000\/full_papers\/smart\/smart.pdf."},{"key":"e_1_3_2_1_33_1","volume-title":"New tool and technique for remote operating system fingerprinting","author":"Veysset F.","year":"2002","unstructured":"F. Veysset , O. Courtay , and O. Heen . New tool and technique for remote operating system fingerprinting . Apr. 2002 . http:\/\/www.gomor.org\/files\/ring-full-paper.pdf. F. Veysset, O. Courtay, and O. Heen. New tool and technique for remote operating system fingerprinting. Apr. 2002. http:\/\/www.gomor.org\/files\/ring-full-paper.pdf."},{"key":"e_1_3_2_1_34_1","volume-title":"RFC Editor","author":"Vida R.","year":"2004","unstructured":"R. Vida and L. Costa . Multicast listener discovery version 2 (mldv2) for ipv6. RFC 3810 , RFC Editor , June 2004 . https:\/\/tools.ietf.org\/html\/rfc3810. R. Vida and L. Costa. Multicast listener discovery version 2 (mldv2) for ipv6. RFC 3810, RFC Editor, June 2004. https:\/\/tools.ietf.org\/html\/rfc3810."},{"key":"e_1_3_2_1_35_1","doi-asserted-by":"publisher","DOI":"10.1109\/DSN.2009.5270338"},{"key":"e_1_3_2_1_36_1","unstructured":"M. Zalewski. p0f - passive os fingerprinting tool June 2000. http:\/\/seclists.org\/bugtraq\/2000\/Jun\/141.  M. Zalewski. p0f - passive os fingerprinting tool June 2000. http:\/\/seclists.org\/bugtraq\/2000\/Jun\/141."},{"key":"e_1_3_2_1_37_1","unstructured":"M. Zalewski. {tool} the new p0f 2.0.1 is now out Sept. 2003. http:\/\/seclists.org\/bugtraq\/2003\/Sep\/36.  M. Zalewski. {tool} the new p0f 2.0.1 is now out Sept. 2003. http:\/\/seclists.org\/bugtraq\/2003\/Sep\/36."},{"key":"e_1_3_2_1_38_1","unstructured":"M. Zalewski. p0f3 release candidate Jan. 2012. http:\/\/seclists.org\/fulldisclosure\/2012\/Jan\/123.  M. Zalewski. p0f3 release candidate Jan. 2012. http:\/\/seclists.org\/fulldisclosure\/2012\/Jan\/123."}],"event":{"name":"CCS'15: The 22nd ACM Conference on Computer and Communications Security","sponsor":["SIGSAC ACM Special Interest Group on Security, Audit, and Control"],"location":"Denver Colorado USA","acronym":"CCS'15"},"container-title":["Proceedings of the 8th ACM Workshop on Artificial Intelligence and Security"],"original-title":[],"link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/2808769.2808777","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/2808769.2808777","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,6,18]],"date-time":"2025-06-18T05:07:43Z","timestamp":1750223263000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/2808769.2808777"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2015,10,16]]},"references-count":38,"alternative-id":["10.1145\/2808769.2808777","10.1145\/2808769"],"URL":"https:\/\/doi.org\/10.1145\/2808769.2808777","relation":{},"subject":[],"published":{"date-parts":[[2015,10,16]]},"assertion":[{"value":"2015-10-16","order":2,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}