Application of Tabular Transformer Architectures for Operating System Fingerprinting

• DOI: 10.48550/arxiv.2502.09084
• Publication Date: 2025-02-13
• Authors: Rubén Pérez-Jove; Cristian R. Munteanu; Alejandro Pazos; José M. Vázquez-Naya
• Keywords: Computer Science - Networking and Internet Architecture; Networking and Internet Architecture (cs.NI); FOS: Computer and information sciences; Computer Science - Machine Learning; Computer Science - Cryptography and Security; Cryptography and Security (cs.CR); Machine Learning (cs.LG)

Operating System (OS) fingerprinting is essential for network management and cybersecurity, enabling accurate device identification based on traffic analysis. Traditional rule-based tools such as Nmap p0f face challenges in dynamic environments due to frequent OS updates obfuscation techniques. While Machine Learning (ML) approaches have been explored, Deep (DL) models, particularly Transformer architectures, remain unexploited this domain. This study investigates the application of Tabular architectures-specifically TabTransformer FT-Transformer-for fingerprinting, leveraging structured data from three publicly available datasets. Our experiments demonstrate that FT-Transformer generally outperforms traditional ML previous across multiple classification levels (OS family, major, minor versions). The results establish a strong foundation DL-based improving accuracy adaptability complex environments. Furthermore, we ensure reproducibility our research by providing an open-source implementation.