Dataset Using TLS Fingerprints for OS Identification in Encrypted Traffic

The dataset consists of data from three different sources; flow records collected from the university backbone network, log entries from the two university DHCP (Dynamic Host Configuration Protocol) servers and a single RADIUS (Remote Authentication Dial In User Service) accounting server. The data was collected from 2019-07-12 00:00 to 2019-07-16 23:59 with a few hours overhead on both sides of the interval for the log entries to cover long connection sessions overlapping to and from the time frame.

We measured the flow data from the university uplink to the Internet. In the dataset, we kept only flows with source IP addresses from university wireless networks (Eduroam). The flow data was then enriched with information from DHCP and RADIUS servers to contain ID of the RADIUS session and operating system od the transmitting device as derived from DHCP logs.

The dataset is in the form of CSV file with the following information fields important for OS identification:

Basic flow features

Date flow start - timestamp of flow start

Date flow end - timestamp of flow end

Src IPv4 - source IPv4 address

sPort - source L4 port

Dst IPv4 - destination IPv4 address

dPort - destination L4 port

Extended TCP/IP parameters

SYN size - the size of the initial SYN packet of a TCP connection (in bytes)

TCP win - value of TCP Window size parameter

TCP SYN TTL - observed TTL value

HTTP parameters

HTTP Host - hostname from the HTTP request

HTTP UA OS - OS identification based on user-agent

HTTP UA OS MAJ - OS identification based on user-agent

HTTP UA OS MIN - OS identification based on user-agent

HTTP UA OS BLD - OS identification based on user-agent

TLS parameters

TLS SNI - Server Name Indication field

TLS SNI length - length of SNI in bytes

TLS Client Version - TLS client hello Version field

Client Cipher Suites - list of supported cipher suites

TLS Extension Types - list of extension IDs

TLS Extension Lengths - list of extension lengths

TLS Elliptic Curves - list of supported curves (or supported groups in TLS1.3)

TLS EC Point Formats - list of EC formats

Log based extensions

Session ID - ID of the session to match flows from one device

Ground Truth OS - OS name derived from log data

The observed network traffic contains privacy-sensitive information. Hereby, we declare that the monitored data used for our research were processed in accordance with the EU General Data Protection Regulation 2016/679. The published dataset was anonymized with cryptographic means using Crypto-PAn algorithm to preserve both the scientific value and user privacy.

When using this dataset, please cite the original work as follows:

@inproceedings{lastovicka2020using,
title={Using TLS Fingerprints for OS Identification in Encrypted Traffic},
author={La{\v{s}}tovi{\v{c}}ka, Martin and {\v{S}}pa{\v{c}}ek, Stanislav and Velan, Petr and {\v{C}}eleda, Pavel},
booktitle = {2020 IEEE/IFIP Network Operations and Management Symposium (NOMS 2020)},
doi = {http://dx.doi.org/10.1109/NOMS47738.2020.9110319},
keywords = {OS fingerprinting;passive monitoring;IPFIX;TLS},
isbn = {978-1-7281-4973-8},
pages = {1-6},
publisher = {IEEE Xplore Digital Library},
year = {2020}
}