Sciweavers

NDSS
2006
IEEE

Protocol-Independent Adaptive Replay of Application Dialog

13 years 8 months ago
Protocol-Independent Adaptive Replay of Application Dialog
For many applications—including recognizing malware variants, determining the range of system versions vulnerable to a given attack, testing defense mechanisms, and filtering multi-step attacks—it can be highly useful to mimic an existing system while interacting with a live host on the network. We present RolePlayer, a system which, given examples of an application session, can mimic both the client side and the server side of the session for a wide variety of application protocols. A key property of RolePlayer is that it operates in an application-independent fashion: the system does not require any specifics about the particular application it mimics. It instead uses byte-stream alignment algorithms to compare different instances of a session to determine which fields it must change to successfully replay one side of the session. Drawing only on knowledge of a few low-level syntactic conventions (such as representing IP addresses using “dotted quads”), and contextual inf...
Weidong Cui, Vern Paxson, Nicholas Weaver, Randy H
Added 12 Jun 2010
Updated 12 Jun 2010
Type Conference
Year 2006
Where NDSS
Authors Weidong Cui, Vern Paxson, Nicholas Weaver, Randy H. Katz
Comments (0)