# Reliable Hierarchical Operating System Fingerprinting via Conformal Prediction

arXiv: https://arxiv.org/abs/2602.12825 · HTML: https://mlsanity.com/paper/2602.12825/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Builds on 6 of its 42 references that are in the map.
- First posted on arXiv 13 Feb 2026.

## Builds on (most cited first, 6 of 6)

- [Conformal Structured Prediction](https://mlsanity.com/paper/2410.06296/) (2024)
- [Conformal Prediction in Hierarchical Classification with Constrained Representation Complexity](https://mlsanity.com/paper/2501.19038/) (2025)
- [Android Malware Detection with Unbiased Confidence Guarantees](https://mlsanity.com/paper/2312.11559/) (2023)
- [Comprehensive Botnet Detection by Mitigating Adversarial Attacks, Navigating the Subtleties of Perturbation Distances and Fortifying Predictions with Conformal Layers](https://mlsanity.com/paper/2409.00667/) (2024)
- [Accurate TLS Fingerprinting using Destination Context and Knowledge Bases](https://mlsanity.com/paper/2009.01939/) (2020)
- [Application of Tabular Transformer Architectures for Operating System Fingerprinting](https://mlsanity.com/paper/2502.09084/) (2025)

## Abstract (arXiv)

Operating System (OS) fingerprinting is critical for network security, but conventional methods do not provide formal uncertainty quantification mechanisms. Conformal Prediction (CP) could be directly wrapped around existing methods to obtain prediction sets with guaranteed coverage. However, a direct application of CP would treat OS identification as a flat classification problem, ignoring the natural taxonomic structure of OSs and providing brittle point predictions. This work addresses these limitations by introducing and evaluating two distinct structured CP strategies: level-wise CP (L-CP), which calibrates each hierarchy level independently, and projection-based CP (P-CP), which ensures structural consistency by projecting leaf-level sets upwards. Our results demonstrate that, while both methods satisfy validity guarantees, they expose a fundamental trade-off between level-wise efficiency and structural consistency. L-CP yields tighter prediction sets suitable for human forensic analysis but suffers from taxonomic inconsistencies. Conversely, P-CP guarantees hierarchically consistent, nested sets ideal for automated policy enforcement, albeit at the cost of reduced efficiency at coarser levels.