<?xml version="1.0" encoding="ISO-8859-1"?><article xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
<front>
<journal-meta>
<journal-id>1405-5546</journal-id>
<journal-title><![CDATA[Computación y Sistemas]]></journal-title>
<abbrev-journal-title><![CDATA[Comp. y Sist.]]></abbrev-journal-title>
<issn>1405-5546</issn>
<publisher>
<publisher-name><![CDATA[Instituto Politécnico Nacional, Centro de Investigación en Computación]]></publisher-name>
</publisher>
</journal-meta>
<article-meta>
<article-id>S1405-55462023000200581</article-id>
<article-id pub-id-type="doi">10.13053/cys-27-2-4429</article-id>
<title-group>
<article-title xml:lang="en"><![CDATA[Identification of Static and Dynamic Security Controls Using Machine Learning]]></article-title>
</title-group>
<contrib-group>
<contrib contrib-type="author">
<name>
<surname><![CDATA[González]]></surname>
<given-names><![CDATA[Florencio J.]]></given-names>
</name>
<xref ref-type="aff" rid="Aff"/>
</contrib>
<contrib contrib-type="author">
<name>
<surname><![CDATA[Aguirre-Anaya]]></surname>
<given-names><![CDATA[Eleazar]]></given-names>
</name>
<xref ref-type="aff" rid="Aff"/>
</contrib>
<contrib contrib-type="author">
<name>
<surname><![CDATA[Salinas-Rosales]]></surname>
<given-names><![CDATA[Moisés]]></given-names>
</name>
<xref ref-type="aff" rid="Aff"/>
<xref ref-type="aff" rid="Aaf"/>
</contrib>
<contrib contrib-type="author">
<name>
<surname><![CDATA[Miyaji]]></surname>
<given-names><![CDATA[Atsuko]]></given-names>
</name>
<xref ref-type="aff" rid="Aff"/>
</contrib>
</contrib-group>
<aff id="Af1">
<institution><![CDATA[,Instituto Politécnico Nacional Computing Research Center Laboratory of Cybersecurity]]></institution>
<addr-line><![CDATA[ ]]></addr-line>
<country>Mexico</country>
</aff>
<aff id="Af2">
<institution><![CDATA[,Osaka University Department of Information and Communications Technology  ]]></institution>
<addr-line><![CDATA[ ]]></addr-line>
<country>Japan</country>
</aff>
<pub-date pub-type="pub">
<day>00</day>
<month>06</month>
<year>2023</year>
</pub-date>
<pub-date pub-type="epub">
<day>00</day>
<month>06</month>
<year>2023</year>
</pub-date>
<volume>27</volume>
<numero>2</numero>
<fpage>581</fpage>
<lpage>592</lpage>
<copyright-statement/>
<copyright-year/>
<self-uri xlink:href="http://www.scielo.org.mx/scielo.php?script=sci_arttext&amp;pid=S1405-55462023000200581&amp;lng=en&amp;nrm=iso"></self-uri><self-uri xlink:href="http://www.scielo.org.mx/scielo.php?script=sci_abstract&amp;pid=S1405-55462023000200581&amp;lng=en&amp;nrm=iso"></self-uri><self-uri xlink:href="http://www.scielo.org.mx/scielo.php?script=sci_pdf&amp;pid=S1405-55462023000200581&amp;lng=en&amp;nrm=iso"></self-uri><abstract abstract-type="short" xml:lang="en"><p><![CDATA[Abstract: During a network scanning, identifying the operating system (OS) running on each network attached host has been a research topic for a long time. Researchers have developed different approaches through network analysis using either passive or active techniques, such techniques are commonly called &#8220;OS fingerprinting&#8221;. According to best security practices, a set of security mechanisms should be applied to prevent OS fingerprinting by penetration testers. This article presents an experimental study to identify the parameters used by security controls to obfuscate their behavior on the network. A novel strategy is proposed to identify network devices despite static and dynamic obfuscation caused by security controls such as NAT, protocol scrubbers, or hardened systems. Targets were identified in virtual and native environments with a high degree of precisión, by means of a layered classification model integrated by K-means, KNN, Naive Bayes, SVM and ADA Boost classifiers.]]></p></abstract>
<kwd-group>
<kwd lng="en"><![CDATA[OS obfuscation]]></kwd>
<kwd lng="en"><![CDATA[OS fingerprinting]]></kwd>
<kwd lng="en"><![CDATA[moving target defense identification]]></kwd>
<kwd lng="en"><![CDATA[security architecture]]></kwd>
<kwd lng="en"><![CDATA[machine learning]]></kwd>
</kwd-group>
</article-meta>
</front><back>
<ref-list>
<ref id="B1">
<nlm-citation citation-type="confpro">
<person-group person-group-type="author">
<name>
<surname><![CDATA[Smith]]></surname>
<given-names><![CDATA[M.]]></given-names>
</name>
<name>
<surname><![CDATA[Hint]]></surname>
<given-names><![CDATA[R.]]></given-names>
</name>
</person-group>
<source><![CDATA[Network security using NAT and NAPT]]></source>
<year>2002</year>
<conf-name><![CDATA[ 10th IEEE International Conference on Networks (ICON]]></conf-name>
<conf-date>2002</conf-date>
<conf-loc> </conf-loc>
<page-range>355-60</page-range></nlm-citation>
</ref>
<ref id="B2">
<nlm-citation citation-type="journal">
<person-group person-group-type="author">
<name>
<surname><![CDATA[Watson]]></surname>
<given-names><![CDATA[D.]]></given-names>
</name>
<name>
<surname><![CDATA[Smart]]></surname>
<given-names><![CDATA[M.]]></given-names>
</name>
<name>
<surname><![CDATA[Malan]]></surname>
<given-names><![CDATA[R.]]></given-names>
</name>
<name>
<surname><![CDATA[Jahanian]]></surname>
<given-names><![CDATA[F.]]></given-names>
</name>
</person-group>
<article-title xml:lang=""><![CDATA[Protocol scrubber: Network security through transparent flow modification]]></article-title>
<source><![CDATA[IEEE/ACM Trans. Netw.]]></source>
<year>2004</year>
<volume>12</volume>
<numero>2</numero>
<issue>2</issue>
<page-range>261-73</page-range></nlm-citation>
</ref>
<ref id="B3">
<nlm-citation citation-type="book">
<person-group person-group-type="author">
<name>
<surname><![CDATA[Jajodia]]></surname>
<given-names><![CDATA[S.]]></given-names>
</name>
<name>
<surname><![CDATA[Ghosh]]></surname>
<given-names><![CDATA[A. K.]]></given-names>
</name>
<name>
<surname><![CDATA[Swarup]]></surname>
<given-names><![CDATA[V.]]></given-names>
</name>
<name>
<surname><![CDATA[Wang]]></surname>
<given-names><![CDATA[C.]]></given-names>
</name>
<name>
<surname><![CDATA[Wang]]></surname>
<given-names><![CDATA[X. S.]]></given-names>
</name>
</person-group>
<source><![CDATA[Moving target defense: Creating asymmetric uncertainty for cyber threats]]></source>
<year>2011</year>
<publisher-name><![CDATA[Springer]]></publisher-name>
</nlm-citation>
</ref>
<ref id="B4">
<nlm-citation citation-type="confpro">
<person-group person-group-type="author">
<name>
<surname><![CDATA[Mongkolluksamee]]></surname>
<given-names><![CDATA[S.]]></given-names>
</name>
<name>
<surname><![CDATA[Fukuda]]></surname>
<given-names><![CDATA[K.]]></given-names>
</name>
<name>
<surname><![CDATA[Pongpaibool]]></surname>
<given-names><![CDATA[P.]]></given-names>
</name>
</person-group>
<source><![CDATA[Counting NATted hosts by observing TCP/IP field behaviors]]></source>
<year>2012</year>
<conf-name><![CDATA[ IEEE International Conference on Communications (ICC)]]></conf-name>
<conf-loc> </conf-loc>
<page-range>1265-70</page-range></nlm-citation>
</ref>
<ref id="B5">
<nlm-citation citation-type="confpro">
<person-group person-group-type="author">
<name>
<surname><![CDATA[Gujar]]></surname>
<given-names><![CDATA[S. N.]]></given-names>
</name>
<name>
<surname><![CDATA[Gupta]]></surname>
<given-names><![CDATA[S. R.]]></given-names>
</name>
<name>
<surname><![CDATA[Ali]]></surname>
<given-names><![CDATA[M. S.]]></given-names>
</name>
</person-group>
<source><![CDATA[Protocol scrubbing: Network security through transparent flow modification using active real time database]]></source>
<year>2010</year>
<conf-name><![CDATA[ International Conference and Workshop on Emerging Trends in Technology (ICWET &#8216;10)]]></conf-name>
<conf-loc>New York, NY, USA </conf-loc>
<page-range>345-50</page-range></nlm-citation>
</ref>
<ref id="B6">
<nlm-citation citation-type="confpro">
<person-group person-group-type="author">
<name>
<surname><![CDATA[Smart]]></surname>
<given-names><![CDATA[M.]]></given-names>
</name>
<name>
<surname><![CDATA[Malan]]></surname>
<given-names><![CDATA[G. R.]]></given-names>
</name>
<name>
<surname><![CDATA[Jahanian]]></surname>
<given-names><![CDATA[F.]]></given-names>
</name>
</person-group>
<source><![CDATA[Defeating TCP/IP stack fingerprinting]]></source>
<year>2000</year>
<volume>9</volume>
<conf-name><![CDATA[ 9th conference on USENIX Security Symposium]]></conf-name>
<conf-loc> </conf-loc>
</nlm-citation>
</ref>
<ref id="B7">
<nlm-citation citation-type="confpro">
<person-group person-group-type="author">
<name>
<surname><![CDATA[Kaur]]></surname>
<given-names><![CDATA[R.]]></given-names>
</name>
<name>
<surname><![CDATA[Singh]]></surname>
<given-names><![CDATA[M.]]></given-names>
</name>
</person-group>
<source><![CDATA[Hardening OS identity by customised masking techniques]]></source>
<year>2009</year>
<conf-name><![CDATA[ Indo US Workshop and Conference on Cyber Security, Cyber Crime and Cyber Forensics]]></conf-name>
<conf-date>2009</conf-date>
<conf-loc> </conf-loc>
</nlm-citation>
</ref>
<ref id="B8">
<nlm-citation citation-type="">
<collab>ISO/IEC</collab>
<source><![CDATA[ISO/IEC 27001:2005 Information technology, Security techniques &#8211; Specification for an Information Security Management System]]></source>
<year>2005</year>
</nlm-citation>
</ref>
<ref id="B9">
<nlm-citation citation-type="book">
<person-group person-group-type="author">
<name>
<surname><![CDATA[Bittman]]></surname>
<given-names><![CDATA[T.]]></given-names>
</name>
</person-group>
<source><![CDATA[Gartner retires the magic quadrant for x86 server virtualization infrastructure]]></source>
<year>2017</year>
<publisher-name><![CDATA[Gartner Inc]]></publisher-name>
</nlm-citation>
</ref>
<ref id="B10">
<nlm-citation citation-type="">
<person-group person-group-type="author">
<name>
<surname><![CDATA[Roualland]]></surname>
<given-names><![CDATA[G.]]></given-names>
</name>
<name>
<surname><![CDATA[Saffroy]]></surname>
<given-names><![CDATA[J. M.]]></given-names>
</name>
</person-group>
<source><![CDATA[IP Personality]]></source>
<year>2001</year>
</nlm-citation>
</ref>
<ref id="B11">
<nlm-citation citation-type="">
<person-group person-group-type="author">
<name>
<surname><![CDATA[Jadhav]]></surname>
<given-names><![CDATA[A.]]></given-names>
</name>
<name>
<surname><![CDATA[Baghel]]></surname>
<given-names><![CDATA[N.]]></given-names>
</name>
<name>
<surname><![CDATA[Rani]]></surname>
<given-names><![CDATA[R.]]></given-names>
</name>
<name>
<surname><![CDATA[Sonavane]]></surname>
<given-names><![CDATA[R.]]></given-names>
</name>
</person-group>
<source><![CDATA[Protocol scrubber proyect]]></source>
<year>2013</year>
</nlm-citation>
</ref>
<ref id="B12">
<nlm-citation citation-type="">
<person-group person-group-type="author">
<name>
<surname><![CDATA[McCabe]]></surname>
<given-names><![CDATA[R.]]></given-names>
</name>
</person-group>
<source><![CDATA[IPLog proyect]]></source>
<year>2001</year>
</nlm-citation>
</ref>
<ref id="B13">
<nlm-citation citation-type="">
<person-group person-group-type="author">
<name>
<surname><![CDATA[Milgram]]></surname>
<given-names><![CDATA[J.]]></given-names>
</name>
<name>
<surname><![CDATA[Cheriet]]></surname>
<given-names><![CDATA[M.]]></given-names>
</name>
<name>
<surname><![CDATA[Sabourin]]></surname>
<given-names><![CDATA[R.]]></given-names>
</name>
</person-group>
<source><![CDATA[&#8220;One against one&#8221; or &#8220;One against all&#8221;: which one is better for handwriting recognition with SVMs?]]></source>
<year>2006</year>
</nlm-citation>
</ref>
</ref-list>
</back>
</article>
