RolePlayer is a system developed by Weidong Cui when he was at ICSI. Given examples of an application session, can mimic both the client side and the server side of the session for a wide variety of application protocols. A key property of RolePlayer is that it operates in an application-independent fashion: the system does not require any specifics about the particular application it mimics. It instead uses byte-stream alignment algorithms to compare different instances of a session to determine which fields it must change to successfully replay one side of the session. Drawing only on knowledge of a few low-level syntactic conventions (such as representing IP addresses using “dotted quads”), and contextual information such as the domain names of the participating hosts, RolePlayer can heuristically detect and adjust network addresses, ports, cookies, and length fields embedded within the session, including sessions that span multiple, concurrent connections on dynamically assigned ports.
- Weidong Cui, Vern Paxson, Nicholas Weaver, and Randy H. Katz, Protocol-Independent Adaptive Replay of Application Dialog, in Proceedings of the 13th Annual Network and Distributed System Security Symposium (NDSS), February 2006