A Statistical Approach to Remote Physical Device Fingerprinting

The dynamic nature of the Internet allows concealment of network identity in the course of network attacks. Linear regression, applied to the problem of determining relative time drift or clock skew of a machine, is proposed to fingerprint unique machine instances. Previous work used convex hull techniques to determine clock skew; while accurate, the linear regression technique is as accurate and provides beneficial statistical byproducts that can be used to estimate population behavior, required sample size, and sample granularity. Statistical techniques are presented that were validated through several data collection experiments by using a network of nearly identical machines. A formula for determining the required sample size given initial error characteristics and desired accuracy was derived. Additionally, artificial delay was introduced to validate the performance of linear regression classification across wide area networks.