OS Fingerprinting and Tethering Detection in Mobile Networks

Mobile OS Fingerprinting
Problem statement
Infer what operating system a device is running by analyzing the packets it’s generating.
Tethering detection: identify mobile devices which are sharing the Internet access

Importance
Tethering detection
Billing for shared access in mobile networks
Security
Policy enforcement in enterprise networks
IMC 2014

Existing Works
IMC 2014

Limitation of Existing Works
Existing works focus on the Internet traffic
Mobile networks impose new challenges:
Dynamic frequency due to power saving
Clock skew, boot time estimation, …
Short connections
TCP flavors, initial sequence number, …
Features might have changed in mobile OSes
TCP MTU, IP flags, …
IMC 2014

Approach
Identify features to fingerprint mobile device OSes
Detect tethering
Clock frequency stability, boot time estimation
IP Time-to-Live, ID Monotonicity
TCP timestamp option, window size scale option, timestamp monotonicity
Combine multiple features
Quantify the performance
Individual and combined features
OS fingerprinting and tethering detection
IMC 2014

Dataset
IMC 2014
Lab trace
56 mobile user traces
14 Android phones and tablets traces
Samsung Galaxy S5, HTC Ones, HTC Inspire phones, Google Nexus 10 tablet
10 iOS traces
iPhone 4s, iPhone5s, iPad 2, iPod Touch
iOS 5.1.1, iOS 6.1
32 Windows laptops traces
running Windows XP or Windows 7
Each capture lasts 10~30 minutes

Other Datasets
IMC 2014

Features
Clock Frequency
The frequency is stable in Android and Windows,
but vary over time in iOS devices
High clock frequency std. suggests iOS

Features
IP ID Monotonicity
Android:
Some devices completely randomize the IP IDs
Some periodically reset to random values.
Windows: IP ID consistently increase monotonically
iOS: randomize the IP ID of each packet
High violation ratio suggests iOS;
low violation ratio suggests Windows.

Features
TCP Timestamp Option
iOS and Android have TCP TS Option,
but Windows doesn’t
Low ratio of TCP TS option suggests Windows.

Features
IP Time-To-Live
TCP Window Size Scale Option
Boot time estimation
IMC 2014

Probability of finding feature fi in all traffic
Probability of finding feature fi in OSx’s traffic
Probability of being OSx
Combining Features
No single feature works in all scenarios
Naïve Bayes classifier
IMC 2014

Tethering Detection
Apply the same technique for tethering detection.
Features which identify mobile devices
IP Time-To-Live
TCP timestamp monotonicity
Clock frequency
Boot time estimation
Multiple OSes
IMC 2014

Evaluation – Single Feature
No single feature identifies all OSes accurately.

Evaluation – Combing Features
Combining all features yields the best result.

Evaluation – Tethering Detection
Combining all features also yields the best result in tethering detection.

Conclusion
Contributions
Identify new features for mobile OS fingerprinting and tethering detection
Develop a probabilistic scheme that combines multiple features
Evaluate the individual and combined features
Combing multiple features yields the best performance
OS fingerprinting: 100% precision, 80% recall
Tethering detection: 79%-89% recall when targeting 80% precision
IMC 2014

Thank You!
IMC 2014
[e-mail]

Backup Slides
IMC 2014

Mobile OS Fingerprinting
IMC 2014

Features
IP Time-To-Live (TTL)
Windows: 64 or 128
iOS and Android: 64

Features
TCP Window Size Scale Option
iOS: 16
Windows and Android: 2, 4, 64, or 256