Ing. Matej Hulák

Proceedings paper

10.23919/SpliTech70133.2026.11685456

Department of Digital Design

Detecting Network Address Translation (NAT) devices is essential for improving network visibility and supporting cybersecurity analysis, yet it remains challenging in heterogeneous network environments. This work evaluates the transferability of machine learning models for NAT detection from controlled environments to operational Internet Service Provider (ISP) networks. Using interpretable features derived from aggregated network flow records, we evaluate multiple machine learning models on three datasets: one collected in a controlled environment and two from real-world ISP network. The gradient boosting model achieves strong performance on individual datasets, reaching F1-scores of up to 96%. However, its performance degrades under cross-dataset evaluation. We further use Shapley Additive Explanations (SHAP) to analyse the generalisation gap, highlighting dataset-dependent decision behaviour and illustrating how differences in traffic characteristics affect model transferability. These results demonstrate the challenges of transferring NAT detection models trained within controlled environments to operational networks.

Proceedings paper

10.23919/CNSM67658.2025.11297565

Department of Digital Design

Machine learning methods in networking research critically depend on the availability of high-quality datasets. While several network traffic datasets exist, they typically focus on backbone traffic, intrusion scenarios, or application behavior, containing a mix of many types of traffic. In this paper, we introduce the CESNET Idle OS Traffic dataset. It contains traffic traces of various operating system in the "idle" state, i.e. without any user interaction, captured in a controlled lab environment. The primary intended use of the dataset is to support research of operating system fingerprinting, but it can also be used to enhance dataset for anomaly and intrusion detection, in forensic analysis, or education. We also release the toolset used to create the dataset, which enable researchers to replicate the measurement process or extend the dataset with additional operating systems.

Proceedings paper

10.23919/CNSM67658.2025.11297445

Department of Digital Design

Accurate identification of device type and operating system in network traffic is crucial for effective network monitoring, security enforcement, and anomaly detection. Nevertheless, creating datasets for this task is limited due to problematic annotation in a real-world environment. We propose Device Annotation Framework (DAF), a modular and extensible open-source framework for annotating large-scale network datasets with operating system and device type labels. To improve annotation precision in complex environments, DAF combines multiple independent annotation sources by label fusion and conflict resolution. We evaluate DAF on a ground truth dataset collected from a mid-sized network and demonstrate its capability to produce high-quality annotations.

Proceedings paper

Department of Digital Design

OS fingerprinting provides valuable information about devices connected to a network infrastructure. Machine Learning (ML) models are presented as a feasible technology in existing studies. However, there is a lack of high-quality datasets to train a well-performing classifier that can be successfully transferred to different network environments. This paper proposes an improved annotation process to create more reliable datasets. Additionally, the paper showcases a new feature, TCP Maximum Segment Size (MSS), that proves to improve passive flow-based OS fingerprinting. The new datasets are used to train and evaluate ML classifiers for OS fingerprinting that are more transferable, with an average F1-score of 86 %. Furthermore, we conducted a thorough analysis, testing models across different networks and scenarios to identify key factors affecting performance. Along with the paper, we publish five annotated datasets that can be used for further research on this topic.

Proceedings paper

10.23919/SpliTech58164.2023.10192974

Department of Digital Design
Department of Applied Mathematics

An important part of network management is to keep knowledge about the connected devices. One of the tools that can provide such information in real-time is passive OS fingerprinting, in particular the method based on analyzing values of specific TCP/IP headers. The state-of-the-art approach is to use machine learning to create such OS classifier. In this paper, we focus on the evaluation of this approach from several perspectives. We took two existing public datasets and created a new one from our network and trained machine learning models to classify the 4 most common operation system families based on selected TCP/IP fields. We compare different models, discuss the need to round TTL values to avoid over-fitting, and test the transferability of models trained on data from different networks. Although TCP/IP-related characteristics of individual operating systems should be independent on where the device is located, our experiments show that a model trained in one network performs much worse in another one, making model creation and deployment more difficult in practice. A good solution may be to combine data from multiple networks. A model trained on a combination of all three datasets exhibited the best results on average across the datasets.

Proceedings paper

Department of Digital Design

This paper describes the context of existing approaches to real-time net- work flow classification and focuses on the contributions of bachelor and master thesis of the author. The paper also proposes several research questions that are planned for the future Ph.D. study.

Proceedings paper

Department of Digital Design

Computer networks are gradually becoming essential people’s needs. The amount of network traffic and network devices is increasing every day due to improvements and expansion of network infrastructure.The new trend of smart phones, watches, fridges and, in general, smart homes connect a high number of new devices into a network infrastructure. Therefore, the overall volume of network traffic grows, and also networks are getting more complex, which means they are harder to monitor. The main focus of our presentation is the monitoring technology for high speed networks that is able to analyze and classify network traffic automatically. Traffic classification is an essential functionality for various purposes, such as network security. Identification of types of network traffic is a part of the process of, e.g., forensic analysis. Therefore, the accurate and fast classification algorithm provides valuable information for network operators and security analysts. As a software prototype for our experiments, we use NEMEA system. We have developed NEMEA modules that contain the classification algorithms. These prototypes allow us to compare different algorithms in an experimental environment with offline data, and the same software module (with the best performance) can also be deployed in production for online analysis.