nPrint Passive OS Detection Reproducibility - Training/Testing Split

[sammasak]

Hi,
Thanks for this great initiative for collecting benchmarks within this field of study.

We have read the documentation on the pcapml project website and if we understand the task correctly, the first 100 packet samples of each device (or IP) is used for testing the classifier, but which packets are used to training the classifier? Are the remaning samples used for training the classifier?

Best regards,
Lukas

[JordanHolland]

The first 100,000 packets for each device are broken up into 1, 10, and 100 packet sequences. Those packet samples are then used for training and testing using a 70/30 or 80/20 split (so around 70,000 packets for training, and 30,000 packets for testing). The dataset linked in the benchmarking repository represents one of the exact scenarios from the original paper.

Hopefully this helps, I am on vacation until July 1 and will be slow to respond.