Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

APFuzz: Towards Automatic Greybox Protocol Fuzzing

Yu Wang, Yang Xiang, Chandra Thapa, Hajime Suzuki

TL;DR

This work proposes APFuzz (Automatic greybox Protocol Fuzzer), which employs a two-stage process of static and dynamic analysis to automatically identify state variables, which are then used to infer an accurate state model during fuzzing.

Abstract

Greybox protocol fuzzing is a random testing approach for stateful protocol implementations, where the input is protocol messages generated from mutations of seeds, and the search in the input space is driven by the feedback on coverage of both code and state. State model and message model are the core components of communication protocols, which also have significant impacts on protocol fuzzing. In this work, we propose APFuzz (Automatic greybox Protocol Fuzzer) with novel designs to increase the smartness of greybox protocol fuzzers from the perspectives of both the state model and the message model. On the one hand, APFuzz employs a two-stage process of static and dynamic analysis to automatically identify state variables, which are then used to infer an accurate state model during fuzzing. On the other hand, APFuzz introduces field-level mutation operations for binary protocols, leveraging message structure awareness enabled by Large Language Models. We conduct extensive experiments on a public protocol fuzzing benchmark, comparing APFuzz with the baseline fuzzer AFLNET as well as several state-of-the-art greybox protocol fuzzers.

APFuzz: Towards Automatic Greybox Protocol Fuzzing

TL;DR

This work proposes APFuzz (Automatic greybox Protocol Fuzzer), which employs a two-stage process of static and dynamic analysis to automatically identify state variables, which are then used to infer an accurate state model during fuzzing.

Abstract

Greybox protocol fuzzing is a random testing approach for stateful protocol implementations, where the input is protocol messages generated from mutations of seeds, and the search in the input space is driven by the feedback on coverage of both code and state. State model and message model are the core components of communication protocols, which also have significant impacts on protocol fuzzing. In this work, we propose APFuzz (Automatic greybox Protocol Fuzzer) with novel designs to increase the smartness of greybox protocol fuzzers from the perspectives of both the state model and the message model. On the one hand, APFuzz employs a two-stage process of static and dynamic analysis to automatically identify state variables, which are then used to infer an accurate state model during fuzzing. On the other hand, APFuzz introduces field-level mutation operations for binary protocols, leveraging message structure awareness enabled by Large Language Models. We conduct extensive experiments on a public protocol fuzzing benchmark, comparing APFuzz with the baseline fuzzer AFLNET as well as several state-of-the-art greybox protocol fuzzers.
Paper Structure (23 sections, 2 equations, 4 figures, 9 tables, 1 algorithm)

This paper contains 23 sections, 2 equations, 4 figures, 9 tables, 1 algorithm.

Table of Contents

  1. Introduction
  2. Background and Motivations
  3. Greybox Protocol Fuzzing
  4. Protocol State Awareness
  5. Message Structure Awareness
  6. Methodology
  7. Framework
  8. Assumptions
  9. Input
  10. Feedback
  11. Fuzzing Loop
  12. State Representation Learning
  13. Input Structure Learning
  14. LLM-based Seed Interpretation
  15. Mutation Scheme
  16. ...and 8 more sections

Figures (4)

  • Figure 1: System framework
  • Figure 2: Changes in candidate state variables during 30 minutes of fuzzing. The vertical axis represents the number of variables, and the horizontal axis represents the number of unique values
  • Figure 3: The inferred state model of LightFTP by APFuzz
  • Figure 4: The inferred state model of OpenSSH by APFuzz