Incremental Fingerprinting in an Open World

TL;DR

The paper tackles open-world network protocol fingerprinting, where not all implementations are known a priori, by integrating fingerprinting with adaptive active automata learning. It introduces Infernal, an incremental fingerprinting framework that first matches implementations to previously learned models and only learns a new model when necessary, using adaptive learning to minimize interactions. The authors prove correctness and analyze asymptotic complexity, showing improvements over naive baselines, and demonstrate substantial reductions in misclassifications across TLS, SSH, BLE, MQTT, and related protocols. The approach enables robust, scalable identification of black-box protocol implementations in realistic open-world settings, with potential for automatic model maintenance and vulnerability analysis. Overall, the work advances practical open-world fingerprinting by fusing closed-world fingerprints with learning to maintain a growing, accurate reference set.

Abstract

Network protocol fingerprinting is used to identify a protocol implementation by analyzing its input-output behavior. Traditionally, fingerprinting operates under a closed-world assumption, where models of all implementations are assumed to be available. However, this assumption is unrealistic in practice. When this assumption does not hold, fingerprinting results in numerous misclassifications without indicating that a model for an implementation is missing. Therefore, we introduce an open-world variant of the fingerprinting problem, where not all models are known in advance. We propose an incremental fingerprinting approach to solve the problem by combining active automata learning with closed-world fingerprinting. Our approach quickly determines whether the implementation under consideration matches an available model using fingerprinting and conformance checking. If no match is found, it learns a new model by exploiting the structure of available models. We prove the correctness of our approach and improvements in asymptotic complexity compared to naive baselines. Moreover, experimental results on a variety of protocols demonstrate a significant reduction in misclassifications and interactions with these black-boxes.

Figures (9)

• Figure 1: Finite state machines representing simplified TLS protocols.
• Figure 2: Hypotheses $\mathcal{H}_0$ and $\mathcal{H}_1$ for SUL $\mathcal{M}\xspace_0$.
• Figure 3: Overview of Incremental Fingerprinting.
• Figure 4: Comparison of Infernal, $RL^{\#}$ and $RAL^{\#}$ for Experiment \ref{['exp1']}. The colors of bars indicate the algorithms for Figs. \ref{['fig:1a']} and \ref{['fig:1b']}. For Fig. \ref{['fig:1c']}, the colors indicate the benchmarks, and the markers indicate the algorithms. The results are averaged over all seeds in all plots. For Fig. \ref{['fig:1c']}, the black lines indicate the standard deviations.
• Figure 5: Comparison of different algorithms for the components of incremental fingerprinting for Experiment \ref{['exp:2']}. In each subplot, color shows CQ, opacity the learning algorithm, and marker the fingerprinting algorithm.

Theorems & Definitions (20)

• Example 1: Finite State Machines
• Example 2: Incremental Fingerprinting (Infernal)
• Definition 1
• Definition 2
• Definition 3
• Definition 4
• Example 3
• Definition 5
• Definition 6
• Example 4