Modern network service vulnerabilities often lurk in protocol state machines and format validation routines. Fuzzing format specifications significantly enhance mutation efficiency. While grey-box metric has proven effective for file parsers’ fuzzing format inference, its direct application to network services faces two fundamental challenges: (1) the prohibitive overhead of network I/O during exhaustive byte-level mutation analysis, and (2) the inability to reconstruct protocol-aware input formats from limited execution feedback. We present ProAnalyzer, a grey-box metric guided framework that enables efficient fuzzing format inference for stateful network service. Utilizing incremental snapshot mechanism, it accelerates inference speed by capturing and restoring snapshots of network services processing unmutated packets. Based on characteristics of network service inputs, we design format partitioning rules and corresponding inference algorithms specifically for network service fuzzing scenarios. We evaluate ProAnalyzer across 11 protocol implementations from the widely-used ProFuzzBench benchmark. The framework achieves: inferring four format types (control fields, delimiters, flow-sensitive fields, and data) in network service inputs at a peak speed of 725.1 bytes/s (average 403.45 bytes/s), with inference results showing up to 71.82% similarity (average 67.11%) compared to semantic methods’ baseline in 3 different protocol. Through 3 case studies, we demonstrate the importance of this dynamic format inference approach for network service fuzzing.

错误:搜索内容不能为空,请输入英文关键词
错误:关键词超出字数限制,请精简
高级检索

ProAnalyzer: Inferring Network Service’s Fuzzing Format with Grey-Box Metric

  • Wenfeng Lin,
  • Yunfei Su,
  • Shuai Zhang,
  • Chaojing Tang

摘要

Modern network service vulnerabilities often lurk in protocol state machines and format validation routines. Fuzzing format specifications significantly enhance mutation efficiency. While grey-box metric has proven effective for file parsers’ fuzzing format inference, its direct application to network services faces two fundamental challenges: (1) the prohibitive overhead of network I/O during exhaustive byte-level mutation analysis, and (2) the inability to reconstruct protocol-aware input formats from limited execution feedback. We present ProAnalyzer, a grey-box metric guided framework that enables efficient fuzzing format inference for stateful network service. Utilizing incremental snapshot mechanism, it accelerates inference speed by capturing and restoring snapshots of network services processing unmutated packets. Based on characteristics of network service inputs, we design format partitioning rules and corresponding inference algorithms specifically for network service fuzzing scenarios. We evaluate ProAnalyzer across 11 protocol implementations from the widely-used ProFuzzBench benchmark. The framework achieves: inferring four format types (control fields, delimiters, flow-sensitive fields, and data) in network service inputs at a peak speed of 725.1 bytes/s (average 403.45 bytes/s), with inference results showing up to 71.82% similarity (average 67.11%) compared to semantic methods’ baseline in 3 different protocol. Through 3 case studies, we demonstrate the importance of this dynamic format inference approach for network service fuzzing.