Determining the operating system of a target computer is disclosed. Subject information describing one or more attributes of the target computer is received. Reference information describing one or more attributes of a reference is received. The subject information is compared with the reference information. A score associated with the comparison is determined.