ProAnalyzer: Inferring Network Service’s Fuzzing Format with Grey-Box Metric
摘要
Modern network service vulnerabilities often lurk in protocol state machines and format validation routines. Fuzzing format specifications significantly enhance mutation efficiency. While grey-box metric has proven effective for file parsers’ fuzzing format inference, its direct application to network services faces two fundamental challenges: (1) the prohibitive overhead of network I/O during exhaustive byte-level mutation analysis, and (2) the inability to reconstruct protocol-aware input formats from limited execution feedback. We present ProAnalyzer, a grey-box metric guided framework that enables efficient fuzzing format inference for stateful network service. Utilizing incremental snapshot mechanism, it accelerates inference speed by capturing and restoring snapshots of network services processing unmutated packets. Based on characteristics of network service inputs, we design format partitioning rules and corresponding inference algorithms specifically for network service fuzzing scenarios. We evaluate ProAnalyzer across 11 protocol implementations from the widely-used ProFuzzBench benchmark. The framework achieves: inferring four format types (control fields, delimiters, flow-sensitive fields, and data) in network service inputs at a peak speed of 725.1 bytes/s (average 403.45 bytes/s), with inference results showing up to 71.82% similarity (average 67.11%) compared to semantic methods’ baseline in 3 different protocol. Through 3 case studies, we demonstrate the importance of this dynamic format inference approach for network service fuzzing.