🤖 machine learning

Reliable Hierarchical Operating System Fingerprinting via Conformal Prediction

This paper introduces and evaluates two structured Conformal Prediction strategies, Level-wise CP and Projection-based CP, to address the limitations of flat classification in OS fingerprinting by demonstrating a fundamental trade-off between the tighter, human-friendly prediction sets of the former and the structurally consistent, policy-ready sets of the latter.

Original authors: Rubén Pérez-Jove, Osvaldo Simeone, Alejandro Pazos, Jose Vázquez-Naya

Published 2026-07-16

📖 6 min read🧠 Deep dive

CC BY 4.0

Original authors: Rubén Pérez-Jove, Osvaldo Simeone, Alejandro Pazos, Jose Vázquez-Naya

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine you are a digital detective trying to figure out what kind of computer is talking to you on the internet. Is it a Windows laptop, an Android phone, or a Linux server? This detective work is called "OS fingerprinting." Usually, detectives look at tiny, unique quirks in how these computers send messages—like the specific way they start a handshake or how big their data packets are. But here's the problem: the internet is a chaotic place. Sometimes the clues are blurry, and a standard detective might confidently shout, "It's definitely an Android!" when it's actually an iPhone. In high-stakes security, that kind of confident mistake can be disastrous.

To fix this, scientists use a mathematical tool called "Conformal Prediction." Think of this not as a crystal ball that gives one single answer, but as a safety net. Instead of saying "It is X," it says, "It is almost certainly one of these three things: X, Y, or Z." This gives a guarantee: if you set your safety net to catch 95% of cases, it will actually catch 95% of the time, no matter how weird the data gets. But there's a catch: operating systems aren't just a flat list of names; they are a family tree. Windows is the grandparent, Windows 10 is the parent, and Windows 10 22H2 is the child. If your safety net says "It's a Mac" but also "It's Windows 10," that's a logical mess. This paper explores how to build a safety net that respects the family tree, ensuring that if you guess a child, you also guess the right parent.

The Family Tree Problem

In the world of network security, identifying an Operating System (OS) is like trying to identify a person in a crowd just by the sound of their footsteps. You might hear a heavy boot (Windows), a light sneaker (Linux), or a specific brand of running shoe (Android). Traditionally, security systems act like a single-minded detective who points at one person and says, "That's the suspect!" But if the detective is wrong, the whole security plan fails.

The authors of this paper realized that OSs have a natural hierarchy, like a family tree. At the top, you have broad families like "Windows" or "Linux." Below that are major versions like "Windows 10" or "Ubuntu 20.04." At the very bottom are the specific minor versions, like "Windows 10 22H2." The problem is that standard "safety net" methods (Conformal Prediction) usually treat every OS as a separate, unrelated item on a list. If you ask them to guess, they might give you a list that includes "Windows 10" and "Android 11" but forgets to include the "Windows" family, or worse, they might say "Android" is the family but "Windows 10" is the specific version. That's like saying, "This animal is a dog, but it's also a cat." It makes no sense.

Two Ways to Build the Safety Net

The researchers tested two different strategies to fix this logical mess, using a dataset of over 100,000 real network traffic records from a university. They wanted to see which method could give a safe, logical list of possibilities without being too vague.

Strategy 1: The Independent Guessers (Level-wise CP)
Imagine you have three different detectives working on the same case. One detective only looks at the family name, another only at the major version, and the third only at the minor version. They don't talk to each other.

How it works: Each detective builds their own safety net independently.
The Result: This method is very sharp. It gives you very small, specific lists. If the family detective is sure it's "Windows," the list is tiny.
The Flaw: Because they don't talk, they sometimes contradict each other. The family detective might say "It's Linux," while the minor version detective says "It's Windows 10." This creates a "Hierarchical Inconsistency Rate" (HIR) of about 30% to 40% in their tests. It's efficient, but it's logically broken.

Strategy 2: The Upward Projector (Projection-based CP)
Now, imagine you have only one detective who looks at the smallest detail (the minor version) and then works their way up the family tree.

How it works: The detective finds the specific leaf (e.g., "Windows 10 22H2") and then says, "Okay, if it's this, it must also be 'Windows 10' and 'Windows'." They project the answer upwards to fill in the blanks.
The Result: This method is perfectly logical. The "Hierarchical Inconsistency Rate" is exactly zero. You never get a "Windows" family with an "Android" child.
The Flaw: It's a bit more cautious. Because it has to include every possible parent of a specific guess, the lists at the top (the family level) get bigger. If the detective is unsure about the specific version, the whole family tree gets included in the safety net, making the list less precise at the top levels.

The Big Trade-Off

The paper's main discovery is a fundamental trade-off between being efficient (small, precise lists) and being consistent (logically perfect lists).

If you need a human to read the results: The "Independent Guessers" (Level-wise CP) are better. A human analyst can look at a list that says "Family: Windows, Version: Android 11" and realize, "Oh, the machine is confused about the version, but it's definitely Windows." They can use their brain to fix the mistake.
If you need a computer to make a decision: The "Upward Projector" (Projection-based CP) is the winner. Automated systems can't handle contradictions. If a computer is told "Block Android" but the list says "Family: Windows," the computer gets stuck. The Projection method guarantees that the list always makes sense, even if the list is a bit longer.

What They Found

The researchers ran their tests 50 times to be sure. They found that both methods successfully caught the right answer at least 95% of the time (when set to that target), proving the safety nets work. However, the "Independent" method produced lists that were about 10-20% smaller at the family level, but they were logically messy. The "Projection" method produced perfectly logical lists, but the family-level lists were slightly larger because they had to account for every possibility.

In the end, the paper suggests that there is no single "best" method. It depends on who is using the answer. If a human is doing the forensic work, the messy but precise method is fine. But if a robot is blocking access to a network, it needs the perfectly logical, slightly larger list to avoid making a silly mistake. The authors have made their code and data available so others can try these methods on their own networks, helping to make the internet a safer place where we know exactly what we are dealing with.

Technical Summary: Reliable Hierarchical Operating System Fingerprinting via Conformal Prediction

Problem Statement
Operating System (OS) fingerprinting is a critical component of network security, asset management, and incident response. However, conventional fingerprinting methods typically rely on point predictions (outputting a single OS label), which are brittle under conditions of severe class imbalance and the open-set nature of network traffic. In high-stakes environments like Bring-Your-Own-Device (BYOD) enforcement, a confident but incorrect prediction can lead to security breaches. Furthermore, standard approaches treat OS identification as a flat classification problem, ignoring the inherent taxonomic hierarchy of operating systems (e.g., Family $\to$ Major Version $\to$ Minor Version). This simplification fails to distinguish between the operational severity of confusing two versions of the same OS family versus misclassifying the family entirely. Additionally, existing methods lack formal uncertainty quantification mechanisms.

Methodology
The authors propose framing OS fingerprinting as a hierarchical classification problem and applying Conformal Prediction (CP) to generate prediction sets with guaranteed marginal coverage. The study utilizes a dataset of 109,663 passive network flow records from a university environment, featuring 112 features across IP, TCP, TLS, and HTTP layers. The ground truth labels are structured into three levels: OS family, major version, and minor version.

The core of the methodology involves training independent Multi-Layer Perceptron (MLP) classifiers for each hierarchy level and wrapping them with two distinct structured CP strategies:

Level-wise CP (L-CP): This approach applies Conformal Prediction independently at each hierarchy level. Each level (family, major, minor) is calibrated separately using its own non-conformity scores and calibration set. This yields separate prediction sets for each level with marginal coverage guarantees specific to that level.
Projection-based CP (P-CP): This approach applies CP only at the leaf level (minor version). The resulting prediction set is then projected upwards to coarser levels by including all ancestors of any retained leaf. This ensures that the prediction sets are hierarchically consistent and nested (i.e., a predicted child implies its parent is also predicted).

The evaluation employs a rigorous framework using 50 Monte Carlo iterations and introduces a novel metric, the Hierarchical Inconsistency Rate (HIR), to quantify logical violations (e.g., "orphan" violations where a child is predicted without its parent, or "sterile" violations where a parent is predicted without any children).

Key Contributions

First Hierarchical CP Application: The paper presents the first application of Conformal Prediction to hierarchical OS fingerprinting, addressing the specific challenges of taxonomic consistency and multi-level uncertainty.
Structured CP Strategies: The introduction and evaluation of L-CP and P-CP, which offer different trade-offs between local efficiency and global structural consistency.
Novel Evaluation Metric: The proposal of the Hierarchical Inconsistency Rate (HIR) to measure logical coherence in hierarchical predictions, moving beyond standard coverage and set size metrics.
Reproducibility: The release of a complete, open-source implementation of the framework and experimental pipeline.

Results
The experimental results, evaluated across significance levels ( $\alpha$ ) from 0.02 to 0.20, reveal a fundamental trade-off between level-wise efficiency and structural consistency:

Validity: Both methods satisfy the marginal coverage guarantees. L-CP achieves coverage rates close to the nominal target ( $1-\alpha$ ) at all levels. P-CP exhibits systematic over-coverage at coarser levels (e.g., achieving ~96% family-level coverage when the target is 90%) because the family set is constructed as the union of ancestors of valid leaves.
Efficiency (Set Size): L-CP produces tighter prediction sets at the family level (e.g., mean set size $\approx$ 0.92 at $\alpha=0.10$ ) compared to P-CP ( $\approx$ 1.06). L-CP's sets can drop below size 1.0 due to frequent empty sets, signaling high uncertainty or out-of-distribution samples.
Structural Consistency (HIR): P-CP achieves a HIR of exactly 0.0 for all $\alpha$ , guaranteeing nested, coherent sets. In contrast, L-CP suffers from frequent taxonomic violations, with HIR peaking around 37% at $\alpha=0.25$ . The HIR for L-CP is non-monotonic, driven by desynchronization between levels (e.g., a parent returning a singleton while a child returns an empty set).
Usability: L-CP achieves high singleton rates (precise predictions) at the family level faster than P-CP. However, P-CP produces fewer empty sets at coarser levels, as a family is only discarded if all its leaf descendants are rejected.

Significance and Operational Implications
The paper concludes that the choice between L-CP and P-CP depends on the specific operational deployment scenario:

Automated Policy Enforcement: The authors recommend P-CP. Automated systems require logical coherence to execute policies (e.g., "Block all Android versions except 11+"). An inconsistent L-CP output (e.g., predicting "Android 11" while the family prediction is "Windows") is unactionable for automated logic. P-CP's guarantee of nested sets ensures that every prediction corresponds to a valid path in the OS taxonomy.
Forensic Triage: The authors suggest L-CP may be preferable for human analysts. Analysts often prioritize the OS family to route incidents and can use domain knowledge to resolve structural inconsistencies. A tighter, calibrated family prediction from L-CP is more valuable than a set inflated by leaf-level noise, even if the minor version predictions are inconsistent.

The work provides a foundational step toward more trustworthy network visibility by moving beyond brittle point predictions to calibrated hierarchical sets, allowing operators to explicitly trade off prediction set size for reliability. Future work is proposed to mitigate efficiency losses in consistent methods through hybrid calibration or hierarchical loss functions, and to explore Mondrian CP for handling extreme class imbalance.

The Family Tree Problem

Two Ways to Build the Safety Net

The Big Trade-Off

What They Found

Technical Summary: Reliable Hierarchical Operating System Fingerprinting via Conformal Prediction

More like this