SpringerLink
Log in

Fuzzing for Stateful Protocol Implementations: Are We There Yet?

  • Conference paper
  • First Online:
Theoretical Aspects of Software Engineering (TASE 2024)

Part of the book series: Lecture Notes in Computer Science ((LNCS,volume 14777))

Included in the following conference series:

Abstract

Stateful protocols, such as FTP, SIP, and RTSP, play a significant role in computer systems. However, their implementation is prone to security vulnerabilities, which have drawn attention from both industry and academia. Various fuzzing techniques, including the AFLNet fuzzer, have been proposed to test stateful protocol implementations. However, the effectiveness of these existing techniques has not been systematically evaluated, and the understanding of their strengths and weaknesses is limited. To fill this gap, we conducted a comprehensive study to explore the performance of state-of-the-art fuzzing techniques on stateful protocols. In particular, we systematically investigated six state-of-the-art fuzzers on 13 widely used programs using identical seed inputs. Our empirical study revealed the following key findings: (i) State coverage guidance effectively navigates through complex states, although with limitations in directly improving code coverage; (ii) Sequence mutation is pivotal yet requires refinement for effectiveness; (iii) Replacement of asynchronous network socket with synchronous shared memory not only improves test throughput but also improve test efficiency. Finally, based on our findings, we further pinpointed the further research in the broad area of stateful protocol fuzzing.

This is a preview of subscription content, log in via an institution to check access.

Access this chapter

Log in via an institution

Subscribe and save

Springer+ Basic
EUR 32.99 /Month
  • Get 10 units per month
  • Download Article/Chapter or Ebook
  • 1 Unit = 1 Article or 1 Chapter
  • Cancel anytime
Subscribe now

Buy Now

Chapter
USD 29.95
Price excludes VAT (Canada)
  • Available as PDF
  • Read on any device
  • Instant download
  • Own it forever
eBook
USD 89.00
Price excludes VAT (Canada)
  • Available as EPUB and PDF
  • Read on any device
  • Instant download
  • Own it forever
Softcover Book
USD 79.99
Price excludes VAT (Canada)
  • Compact, lightweight edition
  • Free ship** worldwide - see info

Tax calculation will be finalised at checkout

Purchases are for personal use only

Institutional subscriptions

Notes

  1. 1.

    To address randomness of fuzzing, we also employ the Mann-Whitney U test [21] and put the data on the online website [15].

References

  1. Alrahem, T., et al.: Interstate: a stateful protocol fuzzer for sip. Defcon 15, 1–5 (2007)

    Google Scholar 

  2. Andronidis, A., Cadar, C.: Snapfuzz: high-throughput fuzzing of network applications. In: Ryu, S., Smaragdakis, Y. (eds.) ISSTA ’22: 31st ACM SIGSOFT International Symposium on Software Testing and Analysis, 18–22 July 2022, pp. 340–351. ACM, Virtual Event, South Korea (2022)

    Google Scholar 

  3. Aschermann, C., Schumilo, S., Abbasi, A., Holz, T.: IJON: exploring deep state spaces via fuzzing. In: 2020 IEEE Symposium on Security and Privacy, SP 2020, 18–21 May 2020, pp. 1597–1612. IEEE, San Francisco, CA, USA (2020)

    Google Scholar 

  4. Atlidakis, V., Godefroid, P., Polishchuk, M.: Restler: stateful REST API fuzzing. In: Proceedings of the 41st International Conference on Software Engineering, ICSE 2019, 25–31 May 2019, pp. 748–758. IEEE/ACM, Montreal, QC, Canada (2019)

    Google Scholar 

  5. Ba, J., Böhme, M., Mirzamomen, Z., Roychoudhury, A.: Stateful greybox fuzzing. In: 31st USENIX Security Symposium (USENIX Security 22), pp. 3255–3272. USENIX Association, Boston, MA, August 2022

    Google Scholar 

  6. Banks, G., Cova, M., Felmetsger, V., Almeroth, K., Kemmerer, R., Vigna, G.: SNOOZE: toward a stateful network protocol fuzzer. In: Katsikas, S.K., López, J., Backes, M., Gritzalis, S., Preneel, B. (eds.) ISC 2006. LNCS, vol. 4176, pp. 343–358. Springer, Heidelberg (2006). https://doi.org/10.1007/11836810_25

    Chapter  Google Scholar 

  7. beyondsecurity: beSTORM (2022). https://www.beyondsecurity.com/bestorm-and-the-sdl

  8. Ferreira, G.M.: SPIKE (2022). https://github.com/guilhermeferreira/spikepp

  9. GitLab: peach-fuzzer-community (2022). https://gitlab.com/peachtech/peach-fuzzer-community

  10. Goodin, D.: NSA-leaking Shadow Brokers just dumped its most damaging release yet (2022). https://arstechnica.com/security/2017/04/nsa-leaking-shadow-brokers-just-dumped-its-most-damaging-release-yet/

  11. Google: AFL (2021). https://github.com/google/AFL

  12. Google: AFLNWE (2021). https://github.com/thuanpv/aflnwe

  13. Gorbunov, S., Rosenbloom, A.: Autofuzz: automated network protocol fuzzing framework. Ijcsns 10(8), 239 (2010)

    Google Scholar 

  14. He, H., Wang, Y.: Pnfuzz: a stateful network protocol fuzzing approach based on packet clustering. Comput. Sci. Inf. Technol. (CS & IT) 10, 61–69 (2020)

    Google Scholar 

  15. Jian, K., et al.: Fuzzing for stateful protocol implementations: are we there yet? Evaluation’s data (2024). https://sites.google.com/view/stateprotocolfuzzevaluation

  16. Li, J., Li, S., Sun, G., Chen, T., Yu, H.: Snpsfuzzer: a fast greybox fuzzer for stateful network protocols using snapshots. IEEE Trans. Inf. Forensics Secur. 17, 2673–2687 (2022)

    Article  Google Scholar 

  17. Liu, D., Pham, V., Ernst, G., Murray, T., Rubinstein, B.I.P.: State selection algorithms and their impact on the performance of stateful network protocol fuzzing. In: IEEE International Conference on Software Analysis, Evolution and Reengineering, SANER 2022, 15–18 March 2022, pp. 720–730. IEEE, Honolulu, HI, USA (2022)

    Google Scholar 

  18. Liu, H., et al.: Labrador: response guided directed fuzzing for black-box IoT devices. In: 2024 IEEE Symposium on Security and Privacy (SP), p. 126. IEEE Computer Society, Los Alamitos, CA, USA (2024)

    Google Scholar 

  19. Luo, Z., et al.: Bleem: packet sequence oriented fuzzing for protocol implementations. In: 32st USENIX Security Symposium, USENIX Security 2023, 9–11 AUGUST 2023. p. Accepted. USENIX Association, ANAHEIM, CA, USA (2023)

    Google Scholar 

  20. Maier, D., Bittner, O., Munier, M., Beier, J.: FiTM: binary-only coverage-guided fuzzing for stateful network protocols. In: Workshop on Binary Analysis Research (BAR), 2022 (2022)

    Google Scholar 

  21. McKnight, P.E., Najab, J.: Mann-whitney u test. The Corsini encyclopedia of psychology (2010)

    Google Scholar 

  22. Meng, R., Mirchev, M., Böhme, M., Roychoudhury, A.: Large language model guided protocol fuzzing. In: Proceedings of the 31st Annual Network and Distributed System Security Symposium (NDSS) (2024)

    Google Scholar 

  23. Natella, R.: Stateafl: greybox fuzzing for stateful network servers. Empir. Softw. Eng. 27(7), 191 (2022)

    Article  Google Scholar 

  24. Natella, R., Pham, V.: Profuzzbench: a benchmark for stateful protocol fuzzing. In: Cadar, C., Zhang, X. (eds.) ISSTA ’21: 30th ACM SIGSOFT International Symposium on Software Testing and Analysis, 11–17 July 2021, pp. 662–665. ACM, Virtual Event, Denmark (2021)

    Google Scholar 

  25. OpenRCE: Sulley (2019). https://github.com/llvm/llvm-project

  26. Pereyda, J.: boofuzz (2022). https://github.com/jtpereyda/boofuzz

  27. Pham, V., Böhme, M., Roychoudhury, A.: AFLNET: a greybox fuzzer for network protocols. In: 13th IEEE International Conference on Software Testing, Validation and Verification, ICST 2020, 24–28 October 2020, pp. 460–465. IEEE, Porto, Portugal (2020)

    Google Scholar 

  28. Qin, S., Hu, F., Zhao, B., Yin, T., Zhang, C.: Registered report: nsfuzz: towards efficient and state-aware network service fuzzing. In: International Fuzzing Workshop (FUZZING) 2022. San Diego, CA, USA (2022)

    Google Scholar 

  29. Schumilo, S., Aschermann, C., Jemmett, A., Abbasi, A., Holz, T.: Nyx-net: network fuzzing with incremental snapshots. In: Bromberg, Y., Kermarrec, A., Kozyrakis, C. (eds.) EuroSys ’22: Seventeenth European Conference on Computer Systems, April 5–8, 2022, pp. 166–180. ACM, Rennes, France (2022)

    Google Scholar 

  30. Shu, Z., Yan, G.: Iotinfer: automated blackbox fuzz testing of iot network protocols guided by finite state machine inference. IEEE Internet Things J. 9(22), 22737–22751 (2022)

    Article  Google Scholar 

  31. Yu, Y., Chen, Z., Gan, S., Wang, X.: Sgpfuzzer: a state-driven smart graybox protocol fuzzer for network protocol implementations. IEEE Access 8, 198668–198678 (2020)

    Article  Google Scholar 

  32. Zhao, B., et al.: StateFuzz: system call-based state-aware linux driver fuzzing. In: 31st USENIX Security Symposium (USENIX Security 22), pp. 3273–3289. USENIX Association, Boston, MA (2022)

    Google Scholar 

  33. Zuo, F., Luo, Z., Yu, J., Liu, Z., Jiang, Y.: Pavfuzz: state-sensitive fuzz testing of protocols in autonomous vehicles. In: 58th ACM/IEEE Design Automation Conference, DAC 2021, 5–9 December 2021, pp. 823–828. IEEE, San Francisco, CA, USA (2021)

    Google Scholar 

Download references

Acknowledgment

The authors would like to thank the anonymous reviewers for their valuable feedback. This work is partly supported by the National Key R &D Program of China under Grant #2022YFB3103900, Strategic Priority Research Program of the CAS under Grant #XDCO2030200, Chinese National Natural Science Foundation (Grants #62032010, #62202462), and Hong Kong RGC/GRF #16205821.

Author information

Authors and Affiliations

  1. Institute of Information Engineering, Chinese Academy of Sciences, Bei**g, China

    Kunpeng Jian, Yanyan Zou, Yeting Li, Menghao Li, Jian Sun, **gyi Shi & Wei Huo

  2. School of Cyber Security, University of Chinese Academy of Sciences, Bei**g, China

    Kunpeng Jian, Yanyan Zou, Yeting Li, Menghao Li, Jian Sun, **gyi Shi & Wei Huo

  3. Key Laboratory of Network Assessment Technology, Chinese Academy of Sciences, Bei**g, China

    Kunpeng Jian, Yanyan Zou, Yeting Li, Menghao Li, Jian Sun, **gyi Shi & Wei Huo

  4. Bei**g Key Laboratory of Network Security and Protection Technology, Bei**g, China

    Kunpeng Jian, Yanyan Zou, Yeting Li, Menghao Li, Jian Sun, **gyi Shi & Wei Huo

  5. Hong Kong University of Science and Technology, Hong Kong, China

    Jialun Cao

Authors
  1. Kunpeng Jian
    View author publications

    You can also search for this author in PubMed Google Scholar

  2. Yanyan Zou
    View author publications

    You can also search for this author in PubMed Google Scholar

  3. Yeting Li
    View author publications

    You can also search for this author in PubMed Google Scholar

  4. Jialun Cao
    View author publications

    You can also search for this author in PubMed Google Scholar

  5. Menghao Li
    View author publications

    You can also search for this author in PubMed Google Scholar

  6. Jian Sun
    View author publications

    You can also search for this author in PubMed Google Scholar

  7. **gyi Shi
    View author publications

    You can also search for this author in PubMed Google Scholar

  8. Wei Huo
    View author publications

    You can also search for this author in PubMed Google Scholar

Corresponding authors

Correspondence to Yeting Li or Wei Huo .

Editor information

Editors and Affiliations

  1. National University of Singapore, Singapore, Singapore

    Wei-Ngan Chin

  2. Shenzhen University, Guangdong, China

    Zhiwu Xu

Rights and permissions

Reprints and permissions

Copyright information

© 2024 The Author(s), under exclusive license to Springer Nature Switzerland AG

About this paper

Check for updates. Verify currency and authenticity via CrossMark

Cite this paper

Jian, K. et al. (2024). Fuzzing for Stateful Protocol Implementations: Are We There Yet?. In: Chin, WN., Xu, Z. (eds) Theoretical Aspects of Software Engineering. TASE 2024. Lecture Notes in Computer Science, vol 14777. Springer, Cham. https://doi.org/10.1007/978-3-031-64626-3_11

Download citation

  • DOI: https://doi.org/10.1007/978-3-031-64626-3_11

  • Published:

  • Publisher Name: Springer, Cham

  • Print ISBN: 978-3-031-64625-6

  • Online ISBN: 978-3-031-64626-3

  • eBook Packages: Computer ScienceComputer Science (R0)

Publish with us

Policies and ethics

Search

Navigation