![](bg8.png)
7 CONCLUSION
Since (Kohno et al., 2005) established the field of
clock skew estimation from network traces, it ex-
panded into various areas, such as identification of
anonymous services (Zander and Murdoch, 2008),
wireless networks (Jana and Kasera, 2010) and web
user identification (Ding-Jie Huang et al., 2012). The
basic idea behind the clock-skew-based identifica-
tion seems to be valid especially in small networks
but some authors already warned that the distribution
of clock skew is not ideal for unique identification
(Ding-Jie Huang et al., 2012).
This study revisited the findings from previous re-
search of the clock-skew-based identification. This
paper argues that the soundness of the clock skew es-
timation does not depend merely on the amount of
packets as previous studies suggested. Instead, the
duration of the measurement is more important as the
effects of the built-in clock skew increases with time.
During the study of the impact of operating sys-
tems on clock skew, we discovered an irregularity of
time stamps originating from Mac OS X and iOS. The
irregularity was clearly visible both during laboratory
experiments, with devices under our control, and dur-
ing the real network experiment, with devices of other
users.
The study of time synchronisation and manipula-
tion unveiled that clock skew can be influenced by
NTP which may prevent to estimate correct clock
skew.
The real network experiment revealed consider-
able difficulties of clock-skew-based identification in
large networks. In our network, the detected clock
skew of almost all devices is in the range between
−50 ppm and 100 ppm with majority much closer to
0 ppm. Time synchronization was employed by up to
40 % of observed devices as their clock skew was very
close to 0 ppm and they were not distinguishable be-
tween each other.
Passive TCP-level fingerprinting of Windows ma-
chines is not possible, Apple operating systems have
unstable clock skew and clock skew of Linux and
BSD machines is affected by running NTP. Appli-
cation level time stamps are always affected by time
modifications.
ACKNOWLEDGEMENTS
This work is a part of the project VG20102015022
supported by Ministry of the Interior of the Czech
Republic. It was also supported by the project FIT-
S-14-2299 of Brno University of Technology.
REFERENCES
Banse, C., Herrmann, D., and Federrath, H. (2012). Track-
ing users on the internet with behavioral patterns:
Evaluation of its practical feasibility. In Information
Security and Privacy Research, volume 376, pages
235–248. Springer Berlin Heidelberg, DE.
Ding-Jie Huang, Kai-Ting Yang, Chien-Chun Ni, Wei-
Chung Teng, Tien-Ruey Hsiang, and Yuh-Jye Lee
(2012). Clock skew based client device identification
in cloud environments. In Advanced Information Net-
working and Applications, pages 526–533.
Eckersley, P. (2010). How unique is your web browser?
In Privacy Enhancing Technologies, volume 6205
of Lecture Notes in Computer Science, pages 1–18.
Springer Berlin Heidelberg, DE.
Herrmann, D., Gerber, C., Banse, C., and Federrath, H.
(2012). Analyzing characteristic host access patterns
for re-identification of web user sessions. In Infor-
mation Security Technology for Applications, volume
7127, pages 136–154. Springer Berlin Heidelberg,
DE.
Jacobson, V., Braden, B., and Borman, D. (1992). RFC
1323 TCP Extensions for High Performance.
Jana, S. and Kasera, S. (2010). On fast and accurate de-
tection of unauthorized wireless access points using
clock skews. IEEE Transactions on Mobile Comput-
ing, 9(3):449–462.
Kohno, T., Broido, A., and Claffy, K. (2005). Remote phys-
ical device fingerprinting. IEEE Transactions on De-
pendable and Secure Computing, 2(2):93–108.
Kumpo
ˇ
st, M. (2008). Context Information and User Profil-
ing. PhD thesis, Masaryk University, CZ.
Lanze, F., Panchenko, A., Braatz, B., and Zinnen, A.
(2012). Clock skew based remote device fingerprint-
ing demystified. In Global Communications Confer-
ence, pages 813–819.
Mills, D. L., Martin, J., Burbank, J., and Kasch, W. (2010).
RFC 5905 Network Time Protocol Version 4: Protocol
and Algorithms Specification.
Murdoch, S. J. (2006). Hot or not: Revealing hidden ser-
vices by their clock skew. In Computer and Communi-
cations Security, pages 27–36, New York, NY, USA.
ACM.
Pol
ˇ
c
´
ak, L., Jir
´
asek, J., and Matou
ˇ
sek, P. (2013). Comments
on ”Remote physical device fingerprinting”. IEEE
Transactions on Dependable and Secure Computing.
Pre-prints.
Sharma, S., Hussain, A., and Saran, H. (2012). Experi-
ence with heterogenous clock-skew based device fin-
gerprinting. In Workshop on Learning from Authorita-
tive Security Experiment Results, pages 9–18. ACM.
Zander, S. and Murdoch, S. J. (2008). An improved clock-
skew measurement technique for revealing hidden ser-
vices. In Proceedings of the 17th Conference on Secu-
rity Symposium, pages 211–225, Berkeley, CA, USA.
USENIX Association.
SECRYPT2014-InternationalConferenceonSecurityandCryptography
298