Protocol-Independent Adaptive Replay of Application Dialog

For many applications—including recognizing malware variants, determining the range of system versions vulnerable to a given attack, testing defense mechanisms, and filtering multi-step attacks—it can be highly useful to mimic an existing system while interacting with a live host on the network. We present RolePlayer, a system which, given examples of an application session, can mimic both the client side and the server side of the session for a wide variety of application protocols. A key property of RolePlayer is that it operates in an application-independent fashion: the system does not require any specifics about the particular application it mimics. It instead uses byte-stream alignment algorithms to compare different instances of a session to determine which fields it must change to successfully replay one side of the session. Drawing only on knowledge of a few low-level syntactic conventions (such as representing IP addresses using “dotted quads”), and contextual inf...

• Type: Conference
• Year: 2006
• Where: NDSS
• Authors: Weidong Cui, Vern Paxson, Nicholas Weaver, Randy H. Katz
• Keywords: Application Session, Computer Networks, NDSS 2006, RolePlayer, Testing Defense Mechanisms