Gradient-oriented gray-box protocol fuzzing
Yinfan Qin, Xiang Li, Jianwen Tian, Taotao Gu, Xiaohui Kuang · 2021
In recent years, protocol fuzzing under gray-box conditions has been widely used in the field of protocol testing. Existing gray-box protocol fuzzers can be divided into two types according to the seed generation method, generation-based fuzzers, and mutation-based fuzzers. The mutation method of the existing mutation-based gray-box protocol fuzzing tools is completely random. In contrast, guided mutation can help fuzzers to explore the state spaces more completely and it will be more efficient. Also, since the seeds in protocol fuzzing have to be in the specification it is important to specified the mutation. To solve such problems, this paper provides a state-guided mutation method in gray scenarios by introducing neural networks to model protocol behavior, which helps explore the state space faster. Besides, we use the gradient of the neural network to identify key features of the data in the seeds so as to guide the mutator for specified mutation. We implement a new gradient-oriented gray-box protocol fuzzer, which can trigger new paths faster and get deeper coverage. Our tool has been experimentally verified to have a 20% improvement over AFLNET. We also study and analyze the key positions in the data displayed by the neural network, and we found that selecting the positions of mutation according to the gradient values can improve the efficiency of some mutators.