Reliable Hierarchical Operating System Fingerprinting via Conformal Prediction

TL;DR

This paper introduces two structured conformal prediction strategies for OS fingerprinting that provide formal uncertainty quantification while respecting the hierarchical taxonomy of operating systems.

Contribution

It proposes level-wise and projection-based conformal prediction methods that incorporate OS hierarchy, addressing limitations of flat classification approaches.

Findings

Both methods satisfy validity guarantees.

Trade-off between efficiency and structural consistency.

Projection-based CP ensures hierarchical consistency.

Abstract

Operating System (OS) fingerprinting is critical for network security, but conventional methods do not provide formal uncertainty quantification mechanisms. Conformal Prediction (CP) could be directly wrapped around existing methods to obtain prediction sets with guaranteed coverage. However, a direct application of CP would treat OS identification as a flat classification problem, ignoring the natural taxonomic structure of OSs and providing brittle point predictions. This work addresses these limitations by introducing and evaluating two distinct structured CP strategies: level-wise CP (L-CP), which calibrates each hierarchy level independently, and projection-based CP (P-CP), which ensures structural consistency by projecting leaf-level sets upwards. Our results demonstrate that, while both methods satisfy validity guarantees, they expose a fundamental trade-off between level-wise efficiency and structural consistency. L-CP yields tighter prediction sets suitable for human forensic analysis but suffers from taxonomic inconsistencies. Conversely, P-CP guarantees hierarchically consistent, nested sets ideal for automated policy enforcement, albeit at the cost of reduced efficiency at coarser levels.