Application of Tabular Transformer Architectures for Operating System Fingerprinting

Alejandro Pazos; Cristian R. Munteanu; Jose V\'azquez-Naya; Rub\'en P\'erez-Jove

REVIEW 3 major objections 7 minor 1 cited by

Application of Tabular Transformer Architectures for Operating System Fingerprinting

T0 review · 3 major / 7 minor · reviewed 2026-08-07 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read FT-Transformer, a tabular Transformer, identifies operating systems from network traffic more accurately than classical machine-learning baselines across three public datasets.

desk verdict A well-written empirical study whose central claim is undermined by test-set leakage: resampling before the split means the reported F1 scores are not measurements on real traffic. read the letter →

arxiv 2502.09084 v1 pith:FWGMKSTB submitted 2025-02-13 cs.CR cs.LGcs.NI

Rubén Pérez-Jove , Cristian R. Munteanu , Alejandro Pazos , Jose Vázquez-Naya This is my paper · ORCID

classification cs.CRcs.LGcs.NI

keywords operatingsystemfingerprintingtabulartransformersFT-TransformerTabTransformernetworktrafficclassificationself-attentiondeeplearningOSidentification

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper argues that a Transformer architecture designed for tabular data, the FT-Transformer, can fingerprint a device's operating system from network-flow features more accurately than established machine-learning models and most previously published methods. It brings attention-based deep learning to a domain that has relied on rule-based tools such as Nmap and p0f or on classical classifiers. The authors evaluate on three public datasets with labels at OS family, major, and minor version levels, reporting that FT-Transformer achieves the best weighted F1 in five of seven tasks, including 90.80% on the DAT1 family task and 79.32% on the challenging DAT2 major-version task. If the result holds on unmodified traffic, it would make Transformer models a strong foundation for adaptive OS identification in dynamic networks.

What carries the argument

The load-bearing object is the FT-Transformer architecture: it embeds each feature—both categorical and numerical—into a token, then runs stacked Transformer layers with multi-head self-attention over the full set of feature tokens, so the model can weight and combine every feature based on the others. The paper pairs it with TabTransformer, which applies self-attention only to categorical embeddings, to isolate the value of handling numerical features in the attention mechanism. Both are trained on tabular network-flow records (IPFIX flows, packet captures, and Nmap OS signatures) with hyperparameters tuned by a genetic sampler under stratified 10-fold cross-validation.

What would settle it

Repeat the experiments with resampling applied only inside cross-validation folds and the final test set left as the original real traffic; if FT-Transformer's weighted F1 drops by more than a few points or no longer beats the random forest and MLP baselines, the paper's main claim would be refuted.

Watch

Extended reading notes

Core claim

The paper's central claim is that FT-Transformer, which applies multi-head self-attention to all input features—categorical and numerical alike—generally outperforms TabTransformer, k-nearest neighbors, random forests, multi-layer perceptrons, and prior AI fingerprinting studies when classifying operating systems from tabular network data. Across seven dataset–granularity combinations, FT-Transformer attains the highest weighted F1 in five: DAT1 family (90.80%), DAT2 major (79.32%) and minor (69.76%), and DAT3 family (92.23%), while random forest edges it on DAT2 family and TabTransformer wins on DAT3 minor. The authors interpret the result as evidence that self-attention captures complex feature interactions in TCP/IP and TLS parameters that classical models miss, and they position FT-Transformer as a new benchmark for DL-based OS fingerprinting.

Load-bearing premise

The reported accuracy assumes the test data is genuine network traffic, but the authors balance the data by discarding real samples and fabricating synthetic ones before splitting into train and test, so the test set is contaminated.

Editorial extensions

If this is right

If FT-Transformer's advantage holds, network administrators can identify OS family and version from passive traffic without maintaining signature databases that go stale as operating systems update.
The method's strong performance on TLS-derived features suggests it can fingerprint devices even when payloads are encrypted, a scenario where rule-based tools degrade.
The attention weights give a natural route to explaining which TCP/IP and TLS parameters drive an OS decision, something opaque classical ensembles offer only indirectly.
The open-source release means other researchers can benchmark their own fingerprinting models against FT-Transformer on the same three datasets with identical preprocessing.
At the major-version level, where prior ML methods often struggled, FT-Transformer's larger margin suggests attention-based interaction modeling is most valuable precisely when classes are many and similar.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

Because SMOTE and random undersampling are applied before the train/test split, the reported F1 scores likely overstate performance on raw network traffic; re-running with resampling restricted to the training folds could reduce FT-Transformer's margins.
The same tabular-Transformer pipeline could plausibly transfer to neighboring problems such as device-type identification, botnet detection, or TLS fingerprinting, but the paper does not test those tasks, so that remains a hypothesis.
The paper's comparison to prior work is complicated by inconsistent class groupings across studies; a head-to-head re-run on identical class definitions would be needed to confirm the claimed ~12-point gain over the TLS decision tree on DAT1.
FT-Transformer's gains may come partly from its ability to exploit the high-cardinality TLS JA3 fingerprint feature in DAT2; ablating features one group at a time would reveal whether the advantage is attention dynamics or simply access to richer inputs.

Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

Short version: this is a decent application paper undone by a classic data-leakage error. SMOTE and random undersampling are applied before the train/test split (Section 4.2), and Section 4.4 confirms the hold-out test set goes through "the same preprocessing pipeline." So the test set contains synthetic minority samples and excludes undersampled majority samples. The scores in Tables 7–9 are not measurements on unmodified network traffic. The abstract's claim that FT-Transformer "generally outperforms" prior methods is therefore not supported, and the comparison to previous work in Table 10 is unfair because prior methods were evaluated on original data.

What is genuinely new is the breadth: no prior work has compared FT-Transformer and TabTransformer across three datasets and three granularities (family, major, minor). The writing is clear, the datasets are real and public, seeds are fixed, hyperparameters are reported, and code is promised. That is real effort. The Table 10 survey of prior benchmarks is useful, even if the leakage makes the new results unreliable.

The soft spots, in order of severity: the leakage is load-bearing. There are also no confidence intervals or significance tests; several margins are small (DAT2 family: RF beats FT-T on F1, 95.33 vs 95.09, and the authors admit this). The "first application" novelty is weak because their own preliminary paper [45] already applied TabTransformer to the Nmap database. The code repository has no commit hash or artifact verification, so the exact pipeline order cannot be independently checked from the manuscript.

This paper deserves peer review, not desk rejection. The question—do tabular Transformers actually help OS fingerprinting?—is worth a careful answer, and the flaw is fixable: move resampling inside cross-validation and leave a pristine held-out test set. A corrected evaluation could shrink, reverse, or preserve the margins. I would send it to a serious referee with the expectation of major revision.

Referee Report

3 major / 7 minor

Summary. The paper applies two tabular Transformer architectures, TabTransformer and FT-Transformer, to OS fingerprinting on three public datasets (DAT1, DAT2, DAT3) at family, major, and minor version granularities. It compares them with kNN, Random Forest, and MLP baselines and with previously published results, reporting that FT-Transformer generally outperforms the baselines and prior work. The paper claims to be the first application of Transformer architectures to OS fingerprinting and provides a public code repository. The core evaluation, however, is compromised by the data preparation order: resampling is applied before the train/test split, so the reported test-set metrics do not reflect performance on unmodified traffic.

Significance. If the central claim were supported by a clean evaluation, the paper would be a useful empirical contribution: it would be one of the first studies of tabular Transformer models for OS fingerprinting, it uses three diverse public datasets, and it reports multiple classification granularities. The open-source code and fixed library versions are strengths. However, the current evaluation protocol invalidates the reported performance numbers and the comparison with prior work, so the significance of the contribution cannot be assessed from the manuscript as written.

major comments (3)

[Sections 4.2 and 4.4] The test set is contaminated by resampling. Section 4.2 applies random undersampling and SMOTE to the full dataset during data preparation and only afterwards describes the stratified train/test split, while Section 4.4 states that the hold-out test set is evaluated with 'the same preprocessing pipeline.' Consequently, the test set contains SMOTE-generated synthetic minority samples and excludes real majority-class samples removed by undersampling. The accuracies and F1 scores in Tables 7-9 therefore do not describe performance on unmodified network traffic, and the comparisons in Table 10 are unfair because prior methods were evaluated on original data. The central claim in the Abstract and Section 5 is unsupported until the test set is held out before any resampling and resampling is performed only inside training folds. The code link does not resolve this issue because no commit hash is provided, so the exact pipeline order cannot be independently confirmed from the manuscript.
[Table 10, DAT2 minor row] Even setting aside the leakage issue, the claim that FT-Transformer 'generally outperforms ... previous approaches' is contradicted by the paper's own comparison table. For DAT2 minor classification, the proposed FT-T achieves 68.52% accuracy and 69.76% F1, while the previously published kNN result [67] is listed with 92.10% accuracy (F1 not reported). The text calls this 'competitive,' but the only quantitative comparison available for that task shows a large accuracy gap. The authors should either provide the missing F1 for [67] under a comparable protocol or explicitly qualify the superiority claim so that it does not extend to this task.
[Tables 7-9] No confidence intervals, standard deviations, or significance tests are reported, and some of the comparisons that support the 'generally outperforms' claim rest on very small margins. For example, in DAT3 family classification FT-T achieves F1 92.23% versus MLP 91.62%, and in DAT3 minor classification TabT achieves 75.90% versus FT-T 75.74%. A single stratified split with fixed seeds cannot establish superiority at these margins. At minimum, the authors should report repeated cross-validation or repeated seeded splits on a pristine test set, together with the resulting variability.

minor comments (7)

[Abstract and Section 3.1.3] The contribution 'First application of the Transformer architecture to OS fingerprinting' is internally contradicted by Section 3.1.3, which cites a preliminary version of this work [45] applying the Transformer architecture to the Nmap database. The novelty claim should be rephrased, for example to 'first detailed comparison of tabular Transformer architectures for OS fingerprinting.'
[Section 4.2] The sentence 'One-Hot Encoding is applied to categorical target variables' is presumably a typo for 'categorical features'; the target variables are not one-hot encoded for the classifiers used in the study.
[Tables 4 and 6] Table 4 states that use_shared_categ_embed is 'Applicable to TabTransformer only,' but Table 6 reports this hyperparameter for FT-T runs. This inconsistency should be resolved.
[Section 4.2] The 'predetermined removal percentages' for random undersampling and the fixed random seed values are not given in the text. Without these values, the reproducibility claim cannot be checked independently of the unversioned repository.
[References] Reference [22] appears to be unrelated to OS fingerprinting; the cited paper by Matoušek and Wagner is in computational geometry. The reference intended for flow-based passive fingerprinting should be corrected.
[Table 10, DAT1 row] In the DAT1 family comparison, the previous DT method has higher accuracy (93.12%) but lower F1 (78.96%) than the proposed FT-T (90.69% accuracy, 90.80% F1). The text should acknowledge this metric trade-off explicitly rather than reporting only the F1 improvement.
[Section 4.2] The order of SMOTE relative to one-hot encoding of categorical features is not stated. If SMOTE is applied after one-hot encoding, the synthetic minority samples may not correspond to valid categorical configurations; this should be clarified.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the paper's central claim is an empirical benchmark result evaluated against held-out labels, not a derivation that reduces to its own inputs.

full rationale

The paper's central claim—that FT-Transformer generally outperforms traditional ML models, previous approaches, and TabTransformer on OS fingerprinting tasks—is supported by direct experimental evaluation on held-out test sets with reported metrics (Tables 7-9). There is no fitted parameter that is renamed as a prediction: hyperparameters are selected via internal cross-validation and the final models are evaluated on a separate hold-out set (Section 4.4). The only load-bearing self-citation is the authors' own preliminary work [45], but the paper explicitly discloses it as a preliminary version and does not use it to justify the empirical result; the current experiments are independently reported. The main methodological weakness, noted in Section 4.2 and 4.4, is that random undersampling and SMOTE are applied before the train/test split, so the test set contains synthetic and resampled instances and does not represent unmodified real traffic. This is a validity and fairness concern about the benchmark comparison, not a circularity concern: the models' outputs are still predictions on labeled instances, and no result is equivalent to its input by construction or forced by a self-citation chain. Therefore the circularity score is 0.

Assumptions & free parameters 3 free parameters · 3 assumptions · 0 invented entities

The central empirical claim rests on undisclosed undersampling percentages, SMOTE-generated samples treated as real test data, and Optuna-selected hyperparameters. The paper also assumes dataset labels are correct and that SMOTE synthetic samples represent real minority-class traffic; these assumptions are not independently validated.

free parameters (3)

Random undersampling removal percentages = Not reported
Section 4.2 says predetermined removal percentages are applied to majority classes for each dataset, but the values are not given; all reported results depend on these choices.
SMOTE sampling strategy = auto
SMOTE is used with the default 'auto' sampling strategy in Section 4.2; because it is applied before the split, the generated samples appear in the test set.
Optuna-selected hyperparameters = See Table 6
Final TabTransformer and FT-Transformer hyperparameters such as learning rate, depth, heads, and dropout are selected by NSGA-II search; the comparison results are contingent on this selection.

assumptions (3)

domain assumption The three public datasets provide accurate OS ground-truth labels.
OS labels are derived from DHCP/RADIUS logs (DAT1), HTTP User-Agent strings (DAT2), and the Nmap OS signature database (DAT3); label noise is not quantified in the paper.
ad hoc to paper SMOTE synthetic samples preserve the distribution of real minority OS traffic.
SMOTE is used in data preparation to balance classes; if synthetic samples leak into the test set, the reported scores are not estimates of real-world performance.
domain assumption Tabular Transformer implementations correctly encode the selected categorical and numerical features.
The paper relies on standard TabTransformer and FT-Transformer implementations without formal verification or independent correctness checks of feature encoding.

how reviews work

0 comments

Cite this review

Pith. "Pith review of Application of Tabular Transformer Architectures for Operating System Fingerprinting." pith.science (2026). https://pith.science/paper/FWGMKSTB

@misc{pith2026250209084,
  author       = {Pith},
  title        = {Pith review of: Application of Tabular Transformer Architectures for Operating System Fingerprinting},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/FWGMKSTB}},
  note         = {Machine review of arXiv:2502.09084}
}

read the original abstract

Operating System (OS) fingerprinting is essential for network management and cybersecurity, enabling accurate device identification based on network traffic analysis. Traditional rule-based tools such as Nmap and p0f face challenges in dynamic environments due to frequent OS updates and obfuscation techniques. While Machine Learning (ML) approaches have been explored, Deep Learning (DL) models, particularly Transformer architectures, remain unexploited in this domain. This study investigates the application of Tabular Transformer architectures-specifically TabTransformer and FT-Transformer-for OS fingerprinting, leveraging structured network data from three publicly available datasets. Our experiments demonstrate that FT-Transformer generally outperforms traditional ML models, previous approaches and TabTransformer across multiple classification levels (OS family, major, and minor versions). The results establish a strong foundation for DL-based OS fingerprinting, improving accuracy and adaptability in complex network environments. Furthermore, we ensure the reproducibility of our research by providing an open-source implementation.

Figures

Figures reproduced from arXiv: 2502.09084 by the authors.

**Figure 2.** Transformer architecture. Source: [4] Since their introduction in 2017 by Google researchers [4], Transformers have revolutionized NLP, excelling in tasks such as machine translation, text summarization, and sentiment analysis. A key advantage of this architecture over RNNs is its parallel processing capability, allowing entire input sequences to be processed simultaneously rather than sequentially. This significant… view at source ↗

**Figure 3.** Diagram of TabTransformer (Tab-T) architecture. Source: [17] [PITH_FULL_IMAGE:figures/full_fig_p006_3.png] view at source ↗

Figures from the paper (6 more)

**Figure 4.** Figure 4: Diagram of FT-Transformer (FT-T) architecture. Source: [17] [PITH_FULL_IMAGE:figures/full_fig_p006_4.png]

**Figure 5.** Figure 5: Classes distribution by OS family version in DAT1 (top-left), DAT2 (top-right), and DAT3 (bottom-centre). 4.2 Data Preparation Data preparation is the process of cleaning, transforming, and balancing datasets to ensure robust model performance and reproducibility. In o…

**Figure 6.** Figure 6: Comparison of F1-scores (weighted) across tested models for various datasets and classification tasks. Each [PITH_FULL_IMAGE:figures/full_fig_p016_6.png]

**Figure 7.** Figure 7: Standardised confusion matrices for the family classification in DAT1 (TabT: left, FT-T: right) [PITH_FULL_IMAGE:figures/full_fig_p017_7.png]

**Figure 8.** Figure 8: Standardised confusion matrices for the family classification in DAT2 (TabT: left, FT-T: right) [PITH_FULL_IMAGE:figures/full_fig_p017_8.png]

**Figure 9.** Figure 9: Standardised confusion matrices for the family classification in DAT3 (TabT: left, FT-T: right) 17 [PITH_FULL_IMAGE:figures/full_fig_p017_9.png]

Discussion (0). Continue with ORCID to comment.

Forward citations

Cited by 1 Pith paper

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

Reliable Hierarchical Operating System Fingerprinting via Conformal Prediction
cs.CR 2026-02 conditional novelty 4.0 of 10

Two conformal prediction variants for hierarchical OS fingerprinting trade set tightness against taxonomic consistency, both achieving marginal coverage.

Reference graph

Works this paper leans on

66 extracted references · 56 canonical work pages · cited by 1 Pith paper

[45]

Towards TabTransformer-based operating system fingerprinting: A preliminary approach using the nmap database,

R. Pérez Jove, A. Pazos, and J. Vázquez Naya, “Towards TabTransformer-based operating system fingerprinting: A preliminary approach using the nmap database,” in Jornadas Nacionales de Investigación en Ciberseguridad (JNIC) (9ª.2024. Sevilla). Universidad de Sevilla. Escuela Técnica Superior de Ingeniería Informática, 2024, pp. 326–331. [Online]. Available...

work page 2024
[67]

Passive operating system identification from TCP/IP packet headers,

R. Lippmann, D. Fried, K. Piwowarski, and W. Streilein, “Passive operating system identification from TCP/IP packet headers,” in Workshop on Data Mining for Computer Security, vol. 40. Citeseer, 2003. 22

work page 2003
[1]

Nmap: the network mapper - free security scanner

nmap.org. Nmap: the network mapper - free security scanner. [Online]. Available: https://nmap.org/

work page
[2]

Zalewski

M. Zalewski. p0f v3. [Online]. Available: https://lcamtuf.coredump.cx/p0f3/#/p0f.shtml

work page
[3]

Passive operating system fingerprinting revisited: Evaluation and current challenges,

M. Laštovi ˇcka, M. Husák, P. Velan, T. Jirsík, and P. ˇCeleda, “Passive operating system fingerprinting revisited: Evaluation and current challenges,” Computer Networks, p. 109782, 2023-04-20. [Online]. Available: https://www.sciencedirect.com/science/article/pii/S138912862300227X

work page 2023
[4]

Attention is all you need,

A. Vaswani, N. Shazeer, N. Parmar, J. Uszkoreit, L. Jones, A. N. Gomez, L. Kaiser, and I. Polosukhin, “Attention is all you need,” 2023-08-01. [Online]. Available: http://arxiv.org/abs/1706.03762

arXiv 2023
[5]

An image is worth 16x16 words: Transformers for image recognition at scale,

A. Dosovitskiy, L. Beyer, A. Kolesnikov, D. Weissenborn, X. Zhai, T. Unterthiner, M. Dehghani, M. Minderer, G. Heigold, S. Gelly, J. Uszkoreit, and N. Houlsby, “An image is worth 16x16 words: Transformers for image recognition at scale,” 2021-06-03. [Online]. Available: http://arxiv.org/abs/2010.11929 19 Application of Tabular Transformer Architectures fo...

arXiv 2021
[6]

Passive os fingerprinting methods in the jungle of wireless networks,

M. Lastovicka, T. Jirsik, P. Celeda, S. Spacek, and D. Filakovsky, “Passive os fingerprinting methods in the jungle of wireless networks,” in NOMS 2018 - 2018 IEEE/IFIP Network Operations and Management Symposium , 2018-04, pp. 1–9, ISSN: 2374-9709

work page 2018

Show all 66 references

[7]

Chapter 8

nmap.org. Chapter 8. remote OS detection | nmap network scanning. [Online]. Available: https: //nmap.org/book/osdetect.html
[8]

A remote active os fingerprinting tool using icmp,

O. Arkin, “A remote active os fingerprinting tool using icmp,”login: the Magazine of USENIX and Sage, vol. 27, no. 2, pp. 14–19, 2002

2002
[9]

Sinfp, unification of active and passive operating system fingerprinting,

P. Auffret, “Sinfp, unification of active and passive operating system fingerprinting,”Journal in computer virology, vol. 6, no. 3, pp. 197–205, 2010

2010
[10]

Fjellskål and K

E.B. Fjellskål and K. Wysocki. (2009) PRADS - passive real-time asset detection system. [Online]. Available: https://github.com/gamelinux/prads

2009
[11]

(2001) Ettercap project

Ornaghi, Alberto, Valleri, Marco, Escobar, Emilio, Costamagna, Gianfranco, Koeppe, Alexander, and Abdulkadir, Ali. (2001) Ettercap project

2001
[12]

Nearest neighbor pattern classification,

T. M. Cover and P. E. Hart, “Nearest neighbor pattern classification,” vol. 13, no. 1, pp. 21–27, publisher: IEEE
[13]

Random forests,

L. Breiman, “Random forests,” vol. 45, no. 1, pp. 5–32, publisher: Springer
[14]

D. E. Rumelhart, G. E. Hinton, and R. J. Williams, Learning internal representations by error propagation. MIT Press
[15]

Revisiting deep learning models for tabular data,

Y . Gorishniy, I. Rubachev, V . Khrulkov, and A. Babenko, “Revisiting deep learning models for tabular data,” 2023-10-26. [Online]. Available: http://arxiv.org/abs/2106.11959

2023 arXiv
[16]

TabTransformer: Tabular data modeling using contextual embeddings,

X. Huang, A. Khetan, M. Cvitkovic, and Z. Karnin, “TabTransformer: Tabular data modeling using contextual embeddings,” 2020-12-11. [Online]. Available: http://arxiv.org/abs/2012.06678

2020 arXiv
[17]

P. Wang. (2024-07-11) lucidrains/tab-transformer-pytorch. [Online]. Available: https://github.com/lucidrains/ tab-transformer-pytorch

2024
[18]

M. Beddoe. The siphon project: the passive network mapping tool. [Online]. Available: https: //github.com/unmarshal/siphon
[19]

Kollmann

E. Kollmann. (2018) Satori. [Online]. Available: https://github.com/xnih/satori

2018
[20]

(2012) Netsleuth

NetGrab. (2012) Netsleuth. [Online]. Available: http://netgrab.co.uk/netsleuth/

2012
[21]

Detection of operation systems in network traffic using IPFIX,

M. Vymlátil, “Detection of operation systems in network traffic using IPFIX,” Brno University of Technology Thesis, 2014

2014
[22]

On gromov’s method of selecting heavily covered points,

J. Matoušek and U. Wagner, “On gromov’s method of selecting heavily covered points,”Discrete & Computational Geometry, vol. 52, no. 1, pp. 1–33, 2014-07-01. [Online]. Available: https://doi.org/10.1007/s00454-014-9584-7

2014 doi
[23]

Improving operating system fingerprinting using machine learning techniques,

T. Al-Shehari and F. Shahzad, “Improving operating system fingerprinting using machine learning techniques,” International Journal of Computer Theory and Engineering , pp. 57–62, 2014. [Online]. Available: http://www.ijcte.org/index.php?m=content&c=index&a=show&catid=54&id=999

2014
[24]

TCP/IP header classification for detecting spoofed DDoS attack in cloud environment,

O. Osanaiye and M. Dlodlo, “TCP/IP header classification for detecting spoofed DDoS attack in cloud environment,” in IEEE EUROCON 2015 - International Conference on Computer as a Tool (EUROCON) , 2015-09, pp. 1–6. [Online]. Available: https://ieeexplore.ieee.org/document/7313736

2015
[25]

Http fingerprinting and advanced assessment techniques,

S. Shah, “Http fingerprinting and advanced assessment techniques,” BlackHat Asia, 2003

2003
[26]

Identify OS from encrypted traffic with TCP/IP stack fingerprinting,

X. Fan, G. Gou, C. Kang, J. Shi, and G. Xiong, “Identify OS from encrypted traffic with TCP/IP stack fingerprinting,” in 2019 IEEE 38th International Performance Computing and Communications Conference (IPCCC). IEEE, 2019, pp. 1–7. [Online]. Available: https://ieeexplore.ieee....

2019
[27]

Operating system classification performance of TCP/IP protocol headers,

A. Aksoy and M. H. Gunes, “Operating system classification performance of TCP/IP protocol headers,” in 2016 IEEE 41st Conference on Local Computer Networks Workshops (LCN Workshops). IEEE, 2016-11, pp. 112–120. [Online]. Available: http://ieeexplore.ieee.org/document/7856145/

2016
[28]

Operating system fingerprinting,

J. Gurary, Y . Zhu, R. Bettati, and Y . Guan, “Operating system fingerprinting,” in Digital Fingerprinting, C. Wang, R. M. Gerdes, Y . Guan, and S. K. Kasera, Eds. Springer, 2016, pp. 115–139. [Online]. Available: https://doi.org/10.1007/978-1-4939-6601-1_7

2016 doi
[29]

Hybrid-augmented device fingerprinting for intrusion detection in industrial control system networks,

C. Shen, C. Liu, H. Tan, Z. Wang, D. Xu, and X. Su, “Hybrid-augmented device fingerprinting for intrusion detection in industrial control system networks,” IEEE Wireless Communications, vol. 25, no. 6, pp. 26–31, 2018-12. [Online]. Available: https://ieeexplore.ieee.org/docume...

2018
[30]

A robust classifier for passive TCP/IP fingerprinting,

R. Beverly, “A robust classifier for passive TCP/IP fingerprinting,” inPassive and Active Network Measurement, C. Barakat and I. Pratt, Eds. Springer, 2004, pp. 158–167

2004
[31]

Faulds: A non-parametric iterative classifier for internet-wide OS fingerprinting,

Z. Shamsi, D. B. H. Cline, and D. Loguinov, “Faulds: A non-parametric iterative classifier for internet-wide OS fingerprinting,” IEEE/ACM Transactions on Networking, vol. 29, no. 5, pp. 2339–2352, 2021-10. [Online]. Available: https://ieeexplore.ieee.org/document/9460308

2021
[32]

Machine learning fingerprinting methods in cyber security domain: Which one to use?

M. Laštoviˇcka, A. Dufka, and J. Komárková, “Machine learning fingerprinting methods in cyber security domain: Which one to use?” in 2018 14th International Wireless Communications & Mobile Computing Conference (IWCMC), 2018-06, pp. 542–547

2018
[33]

Using TLS fingerprints for OS identification in encrypted traffic,

M. Laštoviˇcka, S. Špaˇcek, P. Velan, and P. ˇCeleda, “Using TLS fingerprints for OS identification in encrypted traffic,” in NOMS 2020 - 2020 IEEE/IFIP Network Operations and Management Symposium, 2020-04, pp. 1–6. [Online]. Available: https://ieeexplore.ieee.org/document/9110319

2020
[34]

Applying artificial intelligence for operating system fingerprinting,

R. Pérez-Jove, C. R. Munteanu, A. P. Sierra, and J. M. Vázquez-Naya, “Applying artificial intelligence for operating system fingerprinting,” in Engineering Proceedings, vol. 7. Multidisciplinary Digital Publishing Institute, 2021, p. 51. [Online]. Available: https://www.mdpi.c...

2021
[35]

Operating system fingerprinting tool based on classical machine learning algorithms,

R. Pérez-Jove, C. R. Munteanu, J. Dorado, A. Pazos, and J. Vázquez-Naya, “Operating system fingerprinting tool based on classical machine learning algorithms,” in 2023 JNIC Cybersecurity Conference (JNIC). IEEE, 2023-06-21, pp. 1–8. [Online]. Available: https://ieeexplore.ieee...

2023
[36]

Operating system classification: A minimalist approach,

K. Millar, A. Cheng, H. G. Chew, and C.-C. Lim, “Operating system classification: A minimalist approach,” in 2020 International Conference on Machine Learning and Cybernetics (ICMLC) . IEEE, 2020-12-02, pp. 143–150. [Online]. Available: https://ieeexplore.ieee.org/document/9469571/

2020
[37]

Use of data mining techniques for network data analysis,

J. Barath and M. Liska, “Use of data mining techniques for network data analysis,” in 2021 Communication and Information Technologies (KIT) . IEEE, 2021-10-13, pp. 1–6. [Online]. Available: https://ieeexplore.ieee.org/document/9583755/

2021
[38]

Desktop and mobile operating system fingerprinting based on IPv6 protocol using machine learning algorithms,

S. Salah, M. Abu Alhawa, and R. Zaghal, “Desktop and mobile operating system fingerprinting based on IPv6 protocol using machine learning algorithms,” International Journal of Security and Networks, vol. 17, no. 1, pp. 1–12, 2022

2022
[39]

Towards passive identification of aged android devices in the home network,

D. Bub, L. Hartmann, Z. Bozakov, and S. Wendzel, “Towards passive identification of aged android devices in the home network,” in EICC 2022: Proccedings of the European Interdisciplinary Cybersecurity Conference. ACM, 2022-06-15, pp. 17–20. [Online]. Available: https://dl.acm....

2022
[40]

Evaluation of passive OS fingerprinting methods using TCP/IP fields,

M. Hulák, V . Bartoš, and T.ˇCejka, “Evaluation of passive OS fingerprinting methods using TCP/IP fields,” in 2023 8th International Conference on Smart and Sustainable Technologies, SpliTech 2023, 2023

2023
[41]

An operating system identification method based on active learning,

D. Zhang, Q. Wang, Z. Wei, and S. Chen, “An operating system identification method based on active learning,” in International Conference on Electrical, Computer, and Energy Technologies, ICECET 2022, 2022

2022
[42]

Passive OS identification in imbalanced dataset,

J. Li, Z. Wei, and S. Chen, “Passive OS identification in imbalanced dataset,” in 2023 International Conference on Electrical, Computer and Energy Technologies (ICECET), 2023-11, pp. 1–6. [Online]. Available: https://ieeexplore.ieee.org/abstract/document/10389569

2023
[43]

Advanced passive operating system fingerprinting using machine learning and deep learning,

D. H. Hagos, M. Loland, A. Yazidi, O. Kure, and P. E. Engelstad, “Advanced passive operating system fingerprinting using machine learning and deep learning,” in 2020 29th International Conference on Computer Communications and Networks (ICCCN) , 2020-08, pp. 1–11. [Online]. Av...

2020
[44]

A machine-learning-based tool for passive OS fingerprinting with TCP variant as a novel feature,

D. H. Hagos, A. Yazidi, O. Kure, and P. E. Engelstad, “A machine-learning-based tool for passive OS fingerprinting with TCP variant as a novel feature,”IEEE Internet of Things Journal, vol. 8, no. 5, pp. 3534–3553, 2021-03

2021
[46]

A survey on vision transformer,

K. Han, Y . Wang, H. Chen, X. Chen, J. Guo, Z. Liu, Y . Tang, A. Xiao, C. Xu, Y . Xu, Z. Yang, Y . Zhang, and D. Tao, “A survey on vision transformer,” IEEE Transactions on Pattern Analysis and Machine Intelligence , vol. 45, no. 1, pp. 87–110, 2023

2023
[47]

NetBERT: A pre-trained language representation model for computer networking,

A. Louis and G. Louppe, “NetBERT: A pre-trained language representation model for computer networking,” 2020-06-24. [Online]. Available: https://matheo.uliege.be/handle/2268.2/9060 21 Application of Tabular Transformer Architectures for Operating System Fingerprinting A PREPRINT

2020
[48]

NorBERT: NetwOrk representations through BERT for network analysis & management,

F. Le, D. Wertheimer, S. Calo, and E. Nahum, “NorBERT: NetwOrk representations through BERT for network analysis & management,” in 2022 30th International Symposium on Modeling, Analysis, and Simulation of Computer and Telecommunication Systems (MASCOTS) . IEEE, 2022-10, pp. 2...

2022
[49]

R1dit: Privacy-preserving malware traffic classification with attention-based neural networks,

O. Barut, Y . Luo, P. Li, and T. Zhang, “R1dit: Privacy-preserving malware traffic classification with attention-based neural networks,” IEEE Transactions on Network and Service Management, vol. 20, no. 2, pp. 2071–2085, 2023-06. [Online]. Available: https://ieeexplore.ieee.or...

2023
[50]

Flow transformer: A novel anonymity network traffic classifier with attention mechanism,

R. Zhao, Y . Huang, X. Deng, Z. Xue, J. Li, Z. Huang, and Y . Wang, “Flow transformer: A novel anonymity network traffic classifier with attention mechanism,” in 2021 17th International Conference on Mobility, Sensing and Networking (MSN), 2021, pp. 223–230

2021
[51]

Exploring the use of LLMs to understand network traces,

R. De la Torre Vico, R. Magán-Carrión, and R. A. Rodríguez-Gómez, “Exploring the use of LLMs to understand network traces,” in International Joint Conferences. Springer Nature Switzerland, pp. 122–131
[52]

ET-BERT: A contextualized datagram representation with pre-training transformers for encrypted traffic classification,

X. Lin, G. Xiong, G. Gou, Z. Li, J. Shi, and J. Yu, “ET-BERT: A contextualized datagram representation with pre-training transformers for encrypted traffic classification,” in Proceedings of the ACM Web Conference 2022. ACM, 2022-04-25, pp. 633–642. [Online]. Available: https:...

2022
[53]

Advancing packet-level traffic predictions with transformers

S. Ray, “Advancing packet-level traffic predictions with transformers.” [Online]. Available: https: //www.research-collection.ethz.ch/handle/20.500.11850/569234
[55]

Rethinking data-driven networking with foundation models: challenges and opportunities,

F. Le, M. Srivatsa, R. Ganti, and V . Sekar, “Rethinking data-driven networking with foundation models: challenges and opportunities,” in Proceedings of the 21st ACM Workshop on Hot Topics in Networks , ser. HotNets ’22. Association for Computing Machinery, 2022-11-14, pp. 188...

2022
[56]

Yet another traffic classifier: A masked autoencoder based traffic transformer with multi-level flow representation,

R. Zhao, M. Zhan, X. Deng, Y . Wang, Y . Wang, G. Gui, and Z. Xue, “Yet another traffic classifier: A masked autoencoder based traffic transformer with multi-level flow representation,” vol. 37, pp. 5420–5427
[57]

netFound: Foundation model for network security,

S. Guthula, N. Battula, R. Beltiukov, W. Guo, and A. Gupta, “netFound: Foundation model for network security,” 2023-11-27. [Online]. Available: http://arxiv.org/abs/2310.17025

2023 arXiv
[58]

Lens: A foundation model for network traffic in cybersecurity

Q. Wang, C. Qian, X. Li, Z. Yao, and H. Shao, “Lens: A foundation model for network traffic in cybersecurity.” [Online]. Available: http://arxiv.org/abs/2402.03646
[59]

TrafficGPT: Breaking the token barrier for efficient long traffic analysis and generation,

J. Qu, X. Ma, and J. Li, “TrafficGPT: Breaking the token barrier for efficient long traffic analysis and generation,” 2024-03-18. [Online]. Available: http://arxiv.org/abs/2403.05822

2024 arXiv
[60]

Towards a graph-based foundation model for network traffic analysis

L. Van Langendonck, I. Castell-Uroz, and P. Barlet-Ros, “Towards a graph-based foundation model for network traffic analysis.” [Online]. Available: http://arxiv.org/abs/2409.08111

arXiv
[61]

NetGPT: Generative pretrained transformer for network traffic,

X. Meng, C. Lin, Y . Wang, and Y . Zhang, “NetGPT: Generative pretrained transformer for network traffic,” 2023-05-17. [Online]. Available: http://arxiv.org/abs/2304.09513

2023 arXiv
[62]

NetBench: A large-scale and comprehensive network traffic benchmark dataset for foundation models,

C. Qian, X. Li, Q. Wang, G. Zhou, and H. Shao, “NetBench: A large-scale and comprehensive network traffic benchmark dataset for foundation models,” in 2024 IEEE International Workshop on Foundation Models for Cyber-Physical Systems & Internet of Things (FMSys), pp. 20–25. [Onl...

2024
[63]

Dataset - using TLS fingerprints for OS identification in encrypted traffic

L. Martin, S. Stanislav, V . Petr, and C. Pavel, “Dataset - using TLS fingerprints for OS identification in encrypted traffic.” [Online]. Available: https://zenodo.org/records/3461771
[64]

Dataset - passive operating system fingerprinting revisited - network flows dataset

M. Laštoviˇcka, M. Husák, P. Velan, T. Jirsík, and P.ˇCeleda, “Dataset - passive operating system fingerprinting revisited - network flows dataset.” [Online]. Available: https://zenodo.org/record/7635138
[65]

nmap OS DB - revision 38950: /nmap-releases/nmap-7.94

“nmap OS DB - revision 38950: /nmap-releases/nmap-7.94.” [Online]. Available: https://svn.nmap.org/ nmap-releases/nmap-7.94/nmap-os-db
[66]

[Online]

FinisTerrae III user guide — CESGA technical documentation 1.0.0 documentation. [Online]. Available: https://cesga-docs.gitlab.io/ft3-user-guide/index.html

Pith tools

Reviewed August 7, 2026 · model on record in the stance chip above.

[1] [45]

Towards TabTransformer-based operating system fingerprinting: A preliminary approach using the nmap database,

R. Pérez Jove, A. Pazos, and J. Vázquez Naya, “Towards TabTransformer-based operating system fingerprinting: A preliminary approach using the nmap database,” in Jornadas Nacionales de Investigación en Ciberseguridad (JNIC) (9ª.2024. Sevilla). Universidad de Sevilla. Escuela Técnica Superior de Ingeniería Informática, 2024, pp. 326–331. [Online]. Available...

work page 2024

[2] [67]

Passive operating system identification from TCP/IP packet headers,

R. Lippmann, D. Fried, K. Piwowarski, and W. Streilein, “Passive operating system identification from TCP/IP packet headers,” in Workshop on Data Mining for Computer Security, vol. 40. Citeseer, 2003. 22

work page 2003

[3] [1]

Nmap: the network mapper - free security scanner

nmap.org. Nmap: the network mapper - free security scanner. [Online]. Available: https://nmap.org/

work page

[4] [2]

Zalewski

M. Zalewski. p0f v3. [Online]. Available: https://lcamtuf.coredump.cx/p0f3/#/p0f.shtml

work page

[5] [3]

Passive operating system fingerprinting revisited: Evaluation and current challenges,

M. Laštovi ˇcka, M. Husák, P. Velan, T. Jirsík, and P. ˇCeleda, “Passive operating system fingerprinting revisited: Evaluation and current challenges,” Computer Networks, p. 109782, 2023-04-20. [Online]. Available: https://www.sciencedirect.com/science/article/pii/S138912862300227X

work page 2023

[6] [4]

Attention is all you need,

A. Vaswani, N. Shazeer, N. Parmar, J. Uszkoreit, L. Jones, A. N. Gomez, L. Kaiser, and I. Polosukhin, “Attention is all you need,” 2023-08-01. [Online]. Available: http://arxiv.org/abs/1706.03762

arXiv 2023

[7] [5]

An image is worth 16x16 words: Transformers for image recognition at scale,

A. Dosovitskiy, L. Beyer, A. Kolesnikov, D. Weissenborn, X. Zhai, T. Unterthiner, M. Dehghani, M. Minderer, G. Heigold, S. Gelly, J. Uszkoreit, and N. Houlsby, “An image is worth 16x16 words: Transformers for image recognition at scale,” 2021-06-03. [Online]. Available: http://arxiv.org/abs/2010.11929 19 Application of Tabular Transformer Architectures fo...

arXiv 2021

[8] [6]

Passive os fingerprinting methods in the jungle of wireless networks,

M. Lastovicka, T. Jirsik, P. Celeda, S. Spacek, and D. Filakovsky, “Passive os fingerprinting methods in the jungle of wireless networks,” in NOMS 2018 - 2018 IEEE/IFIP Network Operations and Management Symposium , 2018-04, pp. 1–9, ISSN: 2374-9709

work page 2018