This paper proposes a general network fingerprinting framework, Seqnature, that uses packet sequences as its basic data unit and that makes it simple to implement any fingerprinting technique that can be formulated as a problem of identifying packet exchanges that consistently occur when the fingerprinted event is triggered. We demonstrate the versatility of Seqnature by using it to implement five different fingerprinting techniques, as special cases of the framework, which broadly fall into two categories: (i) fingerprinting techniques that consider features of each individual packet in a packet sequence, e.g., size and direction; and (ii) fingerprinting techniques that only consider stream-wide features, specifically what Internet endpoints are contacted. We illustrate how Seqnature facilitates comparisons of the relative performance of different fingerprinting techniques by applying the five fingerprinting techniques to datasets from the literature. The results confirm findings in prior work, for example that endpoint information alone is insufficient to differentiate between individual events on Internet of Things devices, but also show that smart TV app fingerprints based exclusively on endpoint information are not as distinct as previously reported.

翻译：本文提出一个通用网络指纹提取框架Seqnature，该框架以数据包序列为基本数据单元，可简洁实现任何可表述为识别指纹事件触发时一致出现的数据包交换问题的指纹技术。我们通过将该框架的五个特例——涵盖两大类指纹技术——的实现来展示Seqnature的通用性：(i) 考虑数据包序列中单个数据包特征（如大小和方向）的指纹技术；(ii) 仅考虑流级特征（具体指所连接的互联网端点）的指纹技术。通过将五种指纹技术应用于文献数据集，我们展示了Seqnature如何促进不同指纹技术相对性能的比较。结果证实了先前研究中的发现，例如仅凭端点信息不足以区分物联网设备上的个体事件，同时也表明基于端点信息的智能电视应用指纹区分度低于此前报道。