A Generic Application-Level Protocol Analyzer and its Language

Proceedings of the Symposium on Network and Distributed System Security, NDSS 2007

Volumn , Issue , 2007, Pages

  Borisov, Nikita ^a   Brumley, David J ^b   Wang, Helen J ^c   Dunagan, John ^c   Joshi, Pallavi ^d   Guo, Chuanxiong ^e  

^a UIUC   (United States)

^b CARNEGIE MELLON UNIVERSITY   (United States)

^c MICROSOFT RESEARCH   (United States)

^d UNIVERSITY OF CALIFORNIA   (United States)

^e Nanjing Library   (China)

Author keywords

[No Author keywords available]

Indexed keywords

HTTP; NETWORK SECURITY; PROBLEM ORIENTED LANGUAGES; SYNTACTICS;

APPLICATION PROTOCOLS; APPLICATION-LEVEL PROTOCOL; DOMAINS SPECIFIC LANGUAGES; NETWORK MONITORS; PROTOCOL ANALYZE; PROTOCOL ANALYZERS; REAL TIME ANALYSIS; REAL TIME RESPONSE; RUNTIMES; SECOND GENERATION;

DENIAL-OF-SERVICE ATTACK;

EID: 85180532687     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: None     Document Type: Conference Paper

References (55)

1. K. Anagnostakis, M. Greenwald, S. Ioannidis, and S. Miltchev. Open packet monitoring on FLAME: Safety, performance and applications. In 4th International Working Conference on Active Networks, 2002.
2. D. Anderson. Automated protocol implementation with RTAG. IEEE Transactions in software engineering, 14(3), March 1988.
3. A. Appel and D.C.Wang. JVM TCB: Measurements of the trusted computing base of Java virtual machines. Technical Report CS TR-647-02, Princeton University, Apr. 2002.
4. F. Babich and L. Deotto. Formal methods for specification and analysis of communication protocols. IEEE Communications Surveys and Tutorials, December 2002.
5. G. Back. DataScript — A specification and scripting language for binary data. In Proceedings of Generative Programming and Component Engineering, volume 2487. LNCS, 2002.
6. A. Basu, M. Hayden, G. Morrisett, and T. von Eicken. A language-based approach to protocol construction. In Proceedings of the ACM SIGPLAN workshop on domain specific languages, 1997.
7. A. Begel, S. McCanne, and S. Graham. Bpf+: Exploiting global data-flow optimizations in a generalized packet filter architecture. Computer Communication Review, 29(4), 1999.
8. G. Berry. The Esterel Primer.
9. S. Bishop, M. Fairbairn, M. Norrish, P. Sewell, M. Smith, and K. Wansbrough. Rigorous specification and conformance testing techniques for network protocols, as applied to TCP, UDP, and sockets. In Proceedings of ACM SIGCOMM, 2006.
10. BitTorrent protocol specification. http://www.bittorrent.org/protocol.html/.
11. N. Borisov, D. Brumley, H. Wang, J. Dunagan, P. Joshi, and C. Guo. Generic application-level protocol analyzer and its language. Technical Report MSR-TR-2005-133, Microsoft Research, Feb. 2005.
12. S. Budkowski and P. Dembinski. An introduction to Estelle: A specification language for distributed systems. Computer Networks and ISDN Systems, 1991.
13. C. Castelluccia, W. Dabbous, and S. O’Malley. Generating efficient protocol code from an abstract specification. In Proceedings of the ACM SIGCOMM, 1996.
14. J. Chambers, W. Cleveland, B. Kleiner, and P. Tukey. Graphical Methods for Data Analysis. Wadsworth & Brooks/Cole, 1983.
15. Microsoft Security Bulletin MS01-033, November 2003. http://www.microsoft.com/technet/treeview/default.asp?url=/technet/security/bulletin/MS01-033.asp.
16. M. corporation. Common vulnerabilities and exposures database (CVE). www.cve.mitre.org.
17. T. Dierks and C. Allen. RFC 2246: The TLS protocol version 1.0, January 1999. http://www.ietf.org/rfc/rfc2246.txt.
18. R. Droms. Rfc 2131 - dynamic host configuration protocol, March 1997. http://www.faqs.org/rfcs/rfc2131.html.
19. O. Dubuisson. ASN.1 - Communication Between Heterogeneous Systems. Morgan Kaufmann Publishers, 2000.
20. D. Engler and M. Kaashoek. DPF: Fast, flexible message demultiplexing using dynamic code generation. In Proceedings of ACM SIGCOMM, 1996.
21. R. Fielding, J. Gettys, J. Mogul, H. Frystyk, L. Masinter, P. Leach, and T. Berners-Lee. RFC 2616: Hypertext Transfer Protocol – HTTP/1.1, June 1999.
22. K. Fisher and R. Gruber. PADS: A domain-specific language for processing ad hoc data. In Proceedings of PLDI, June 2005.
23. M. Fiuczynski, R. Martin, B. Bershad, and D. Culler. SPINE: An operating system for intelligent network adapters. Technical Report TR-98-08-01, University of Washington, 1998.
24. M. Fratto. Application-level firewalls: Smaller net, tighter filter, March 2003. http://www.nwc.com/1405/1405f32.html.
25. E. Gamma, R. Helm, R. Johnson, and J. Vlissides. Design Patterns. Addison-Wesley Professional, 1995.
26. M. Handley, H. Schulzrinne, E. Schooler, and J. Rosenberg. RFC 2543: SIP: Session initiation protocol, March 1999.
27. D. Harel. Statecharts: A visual formalism for complex systems. Science of Computer Programming, pages 231–274, 1987.
28. Hogwash. http://sourceforge.net/projects/hogwash/.
29. Malformed HOST header causes IIS DoS, October 2002. http://www.securiteam.com/windowsntfocus/6C00C1F5QA.html.
30. S. Hudson. CUP: LALR parser generator for Java. http://www2.cs.tum.edu/projects/cup/.
31. V. Jacobson, C. Leres, and S. McCanne. Tcpdump. www.tcpdump.org.
32. M. Jayaram and R. Cytron. Efficient demultiplexing of network packets by automatic parsing. In Proceedings of the Workshop on Compiler Support for Systems Software, 1996.
33. S. Johnson. Yacc — Yet Another Compiler-Compiler, 1979. UNIX Programmer’s Manual.
34. E. Kohler, M. Kaashoek, and D. Montgomery. A readable TCP in the Prolac protocol language. In Proceedings of ACM SIGCOMM, 1999.
35. P. J. McCann and S. Chandra. PacketTypes: Abstract specification of network protocol messages. In Proceedings of ACM SIGCOMM, 2000.
36. S. McCanne and V. Jacobson. The BSD packet filter: A new architecture for user-level packet capture. In USENIX Symposium, 1992.
37. P. Mockapetris. RFC 1035 — Domain names — implementation and specification, November 1987. http://www.faqs.org/rfcs/rfc1035.html.
38. Microsoft Security Bulletin MS03-026, September 2003. http://www.microsoft.com/technet/treeview/default.asp?url=/technet/security/bulletin/MS03-026.asp.
39. G. Necula. Proof-carrying code. In Proceedings of the 24th ACM SIGPLAN-SIGACT Symposium on Principles of Programming Langauges (POPL’97), pages 106–119, Paris, Jan. 1997.
40. NISCC Vulnerability Advisory DNS - 589088, May 2005. http://www.niscc.gov.uk/niscc/docs/al-2005052400433.html.
41. P. Nyblom. The bit syntax — the released version. In Sixth International Erlang/OTP User Conference, October 2000.
42. S. W. O’Malley, T. A. Proebsting, and A. B. Montz. USC: A universal stub compiler. In Proceedings of ACM SIGCOMM, 1994.
43. R. Pang, V. Paxson, R. Sommer, and L. Peterson. binpac: A yacc for writing application protocol parsers. In ACM Internet Measurement Conference, Oct. 2006.
44. T. Parr and R. Quong. ANTLR: A predicated-LL(k) parser generator. Software: Practice and Experience, 25(7):789–810, 1995.
45. V. Paxson. Bro: A system for detecting network intruders in real-time. Computer Networks, Dec 1999.
46. T. H. Romer, D. Lee, G. Voelker, A. Wolman, W. Wong, J.-L. Baer, B. Bershad, and H. Levy. The structure and performance of interpreters. In Proceedings of the 7th International Conference on Architectural Support for Programming Languages and Operating System (ASPLOS), volume 31:9, pages 150–159, New York, NY, 1996. ACM Press.
47. DCE 1.1: Remote Procedure Call. http://www.opengroup.org/onlinepubs/9629399/.
48. http://www.sdl-forum.org/Publications/index.htm.
49. C. Shannon and D. Moore. The spread of the Witty worm. http://www.caida.org/analysis/security/witty, 2004.
50. R. Sharpe, E. Warnicke, and U. Lamping. Ethereal. www.ethereal.com.
51. The Open Source Network Intrusion Detection System. http://www.snort.org/.
52. Apache core features. http://httpd.apache.org/docs/1.3/mod/core.html.
53. P. H. J. van Eijk, C. A. Vissers, and M. D. (Editors). The formal description technique LOTOS.
54. H. Wang, C. Guo, D. Simon, and A. Zugenmaier. Shield: Vulnerability-driven network filters for preventing known vulnerability exploits. In Proceedings of ACM SIGCOMM, 2004.
55. T. Ylonen and C. Lonvick. Internet Draft - SSH Transport Layer Protocol, March 2005.