WinNTGen : Creation of a Windows NT 5.0+ network traffic generator

The Lincoln Adaptable Real Time Information Assurance Testbed (LARIAT) project is the first fully automatable network testbed for the evaluation of information assurance (IA) technologies. It allows researchers to easily set up experiments that evaluate the accuracy of host-based and network-based intrusion detection systems (IDSs). Initially, the network traffic it could produce used UNIX services and protocols as implemented for the Linux and Solaris platforms. However, due to the widespread deployment of Windows-based systems in production environments, it is necessary to include Windows-based traffic when testing IA systems in order to provide a comprehensive evaluation. This thesis describes WinNTGen, a Windows network traffic generation system that integrates into the existing LARIAT framework and enables it to produce Windows-based network traffic. To do this, WinNTGen simulates the actions of a user controlling applications that in turn use network resources. This frees WinNTGen from the need to re-implement network protocols and allows it to operate at a higher level of abstraction. WinNTGen controls applications via loadable libraries that encapsulate the manner in which a typical user interacts with a particular application. The statistical parameters that specify the behavior of a user with each application are derived from real users' behavioral data as they interacted with each application. The system is flexible and extensible so that different versions of the same application as well as additional applications can be controlled by modifying and adding libraries. Finally, the reality and the throughput of the network traffic produced by the WinNTGen system are evaluated.

Department dc:contributor.department

Massachusetts Institute of Technology. Dept. of Electrical Engineering and Computer Science.

Grantor dc:publisher

Massachusetts Institute of Technology

Year dc:date.issued

2003

Author dc:creator

• Boothe-Rabek, Jesse C. (Jesse Clayton), 1979-

Advisor dc:contributor.advisor

• Robert K. Cunningham.

• Electrical Engineering and Computer Science.

Statement dc:rights

• M.I.T. theses are protected by copyright. They may be viewed from this source for any purpose, but reproduction or distribution in any format is prohibited without written permission. See provided URL for inquiries about permission.

Licence dc:rights.uri

• http://dspace.mit.edu/handle/1721.1/7582

Language dc:language.iso

eng

Handle dc:identifier.uri

http://hdl.handle.net/1721.1/29667

OAI identifier oai:identifier

oai:dspace.mit.edu:1721.1/29667