Bugs in network protocol programs exhibit statefulness, making it challenging for fuzzers to generate effective testcases without knowledge of the protocol. Additionally, features such as network transmission and communication synchronization can decrease the execution efficiency of fuzzing in these programs compared to local applications. Current network protocol fuzzing mainly focuses on state inference or execution speed optimization, but these two types of research are orthogonal to each other. However, we observe that enhancing the speed of execution may also increase the power of state inference, leading to improvements in both execution efficiency and testcase generation. In this paper, we introduce FSFuzzer, which leverages shared memory based message transmission and session state sharing based synchronization to alleviate the heavy post-execution analysis in StateAFL state inference. Our experimental results show that FSFuzzer accelerates the execution speed by 4.7x compared to StateAFL. Moreover, we find that the increase in execution speed also boosts StateAFL’s state inference ability, allowing FSFuzzer to infer richer state model information and better guide testcase generation, achieving a notable increase in code coverage and bug-finding capability compared to StateAFL on tested programs.

错误:搜索内容不能为空,请输入英文关键词
错误:关键词超出字数限制,请精简
高级检索

FSFuzzer: A High-Performance Greybox Fuzzer for Stateful Network Protocol

  • Qian Liu,
  • Lei Zhou,
  • Xu Zhou,
  • Yuan Wei,
  • Danjun Liu,
  • Zhendong Wu

摘要

Bugs in network protocol programs exhibit statefulness, making it challenging for fuzzers to generate effective testcases without knowledge of the protocol. Additionally, features such as network transmission and communication synchronization can decrease the execution efficiency of fuzzing in these programs compared to local applications. Current network protocol fuzzing mainly focuses on state inference or execution speed optimization, but these two types of research are orthogonal to each other. However, we observe that enhancing the speed of execution may also increase the power of state inference, leading to improvements in both execution efficiency and testcase generation. In this paper, we introduce FSFuzzer, which leverages shared memory based message transmission and session state sharing based synchronization to alleviate the heavy post-execution analysis in StateAFL state inference. Our experimental results show that FSFuzzer accelerates the execution speed by 4.7x compared to StateAFL. Moreover, we find that the increase in execution speed also boosts StateAFL’s state inference ability, allowing FSFuzzer to infer richer state model information and better guide testcase generation, achieving a notable increase in code coverage and bug-finding capability compared to StateAFL on tested programs.