{"id":105,"date":"2015-06-19T13:46:28","date_gmt":"2015-06-19T13:46:28","guid":{"rendered":"http:\/\/carleton.ca\/nmai\/?page_id=105"},"modified":"2026-02-10T14:58:51","modified_gmt":"2026-02-10T19:58:51","slug":"experiment-2009-04","status":"publish","type":"page","link":"https:\/\/carleton.ca\/nmai\/research-projects\/hosd\/experiment-2009-04\/","title":{"rendered":"Experiment 2009-04"},"content":{"rendered":"\n
\n
\n\n
\n
\n
\n

\n Experiment 2009-04\n <\/h1>\n \n \n <\/header>\n\n <\/div>\n\n <\/div>\n\n <\/div>\n<\/section>\n\n\n\n

This experiment evaluate the accuracy of different OSD tools to identify the actual operating system of a computer. The experiment relies on 95 targets with different OSes as part of the vlab testbed at CRC Canada. We rely on a set of 6,656 traffic traces to evaluate passive tools, while active tools had access to the actual targets. We fed each trace to a passive tool and record its output as the set of possible OSes. For active tools, we run the tool once against each target and use the output as the set of possible OSes for all the traces related to that target.<\/p>\n\n\n\n

Experiment Results<\/h2>\n\n\n\n

Recall<\/h3>\n\n\n\n

The recall measure is computed by the number of traces for which the tool provided the good answer (i.e., the actual OS was among the set of possible OSes provided by the tool) divided by the number of traces analyzed.<\/p>\n\n\n\n

Hence, the higher the reaall is, the better.<\/p>\n\n\n\n