HeadPrint: Detecting anomalous communications through header-based application fingerprinting

Riccardo Bortolameotti, Thijs Van Ede, Andrea Continella, Thomas Hupperich, Maarten H. Everts, Reza Rafati, Willem Jonker, Pieter Hartel, Andreas Peter

Research output: Chapter in Book/Conference proceedings/Edited volumeConference contributionScientificpeer-review

1 Citation (Scopus)
20 Downloads (Pure)


Passive application fingerprinting is a technique to detect anomalous outgoing connections. By monitoring the network traffic, a security monitor passively learns the network characteristics of the applications installed on each machine, and uses them to detect the presence of new applications (e.g., malware infection). In this work, we propose HeadPrint, a novel passive fingerprinting approach that relies only on two orthogonal network header characteristics to distinguish applications, namely the order of the headers and their associated values. Our approach automatically identifies the set of characterizing headers, without relying on a predetermined set of header features. We implement HeadPrint, evaluate it in a real-world environment and we compare it with the state-of-the-art solution for passive application fingerprinting. We demonstrate our approach to be, on average, 20% more accurate and 30% more resilient to application updates than the state-of-the-art. Finally, we evaluate our approach in the setting of anomaly detection, and we show that HeadPrint is capable of detecting the presence of malicious communication, while generating significantly fewer false alarms than existing solutions.

Original languageEnglish
Title of host publicationSAC 2020
Subtitle of host publicationProceedings of the 35th Annual ACM Symposium on Applied Computing
PublisherAssociation for Computing Machinery (ACM)
Number of pages10
ISBN (Print)978-1-4503-6866-7
Publication statusPublished - 2020
Event35th Annual ACM Symposium on Applied Computing, SAC 2020 - Brno, Czech Republic
Duration: 30 Mar 20203 Apr 2020


Conference35th Annual ACM Symposium on Applied Computing, SAC 2020
CountryCzech Republic


  • Anomaly detection
  • Application fingerprinting
  • Network security


Dive into the research topics of 'HeadPrint: Detecting anomalous communications through header-based application fingerprinting'. Together they form a unique fingerprint.

Cite this