Enhancing Coverage in Stateful Protocol Fuzzing via Value-Based Selection
Laile Xi, Heng Zhang, Shenghao Lin, Weidong Zhang, Yuyan Sun, Hongsong Zhu, Limin Sun · 2024
The stateful nature inherent in network protocol implementations presents distinctive challenges for testing and verification methods, including Fuzzing. However, not all states hold equal significance. Indiscriminate state selection for fuzzing could lead to intricate path mazes. Similar challenges emerge in the selection for seeds and mutation operators. Therefore, overcoming the efficiency constraints of current fuzzers crucially depends on making precise selections in fuzzing. In this study, we present AcSelector, a novel approach that incorporates the Composite State Model and Mutation Operator Value Table. By offering the most strategic combination of {state, seed, mutation operator}, AcSelector provides systematic guidance for fuzzing, leading to enhanced code coverage. To quantify value of targets, AcSelector employs a principled evaluation strategy. We evaluated AcSelector by fuzzing six network servers from popular open-source projects. Our experimental results demonstrate the effectiveness of AcSelector in increasing code coverage, even under low fuzzing throughput conditions.