A framework for malicious workload generation

Malicious traffic from self-propagating worms and denialof-service attacks constantly threatens the everyday operation of Internet systems. Defending networks from these threats demands appropriate tools to conduct comprehensive vulnerability assessments of networked systems. This paper describes MACE, a unique environment for recreating a wide range of malicious packet traffic in laboratory testbeds. MACE defines a model for flexible composition of malicious traffic that enables both known attacks (such as the Welchia worm) and new attack variants to be created. We implement this model in an extensible library for attack traffic specification and generation. To demonstrate the capability of MACE, we provide an analysis of stress tests conducted on a popular firewall and two popular network intrusion detection systems. Our results expose potential weaknesses of these systems and reveal that modern firewalls and network intrusion detection systems could be easily overwhelmed by si...

• Type: Conference
• Year: 2004
• Where: IMC
• Authors: Joel Sommers, Vinod Yegneswaran, Paul Barford
• Keywords: IMC 2004, Intrusion Detection Systems, Malicious Traffic, Network Intrusion Detection