CustomPro: Network Protocol Customization Through Cross-Host Feature Analysis

With the increasing popularity of multi-core processors and multithread languages/frameworks, race conditions-which are nondeterministic by nature-are becoming a main root cause for concurrency bugs. It opens doors to malicious attacks such as remote code execution and denial of service attacks, potentially putting millions of users in danger. Yet, such non-deterministic racing conditions are often difficult to identify or reproduce in standard program testing. In this paper, we focus on the Garbage-Collection (GC) feature, which is known to be a frequent victim of concurrency bugs in many software systems. We develop a new approach to facilitate the testing of GC-related bugs through critical condition restoration. In particular, we propose a risk-score mechanism to quantify the risk of GC-related bugs in target functions and leverage the score to select appropriate testing parameters and garbage generation strategy, with a higher chance of producing the critical condition. Our experimental results show that the proposed approach could significantly improve the probability of finding GC-related bugs (from 0 in condition-oblivious testing to 14.8 bugs identified in our experiment) while incurring only around 26% execution overhead. CCS CONCEPTS • Software and its engineering → Software testing and debugging; Garbage collection; Software reliability.

show abstract

Exploring Effective Fuzzing Strategies to Analyze Communication Protocols

Chen,

Mei,

Lan

et al. 2024

Digital Threats

View full text Add to dashboard Cite

While coverage-based greybox fuzzing has gained great success in the field of vulnerability detection due to its simplicity and efficiency, it could become less powerful when applied directly to protocol fuzzing due to the unique challenges of protocol fuzzing. In particular, (1) The implementation of protocols usually involves multiple program binaries, i.e., multiple fuzzing entries; (2) The communication among multiple ends contains more than one packet, which are not necessarily dependent upon each other, i.e., fuzzing single (usually the first) packet can only achieve extremely limited code coverage. In this paper, we study such challenges and demonstrate the limitation of current non-stateful greybox fuzzer. In order to achieve higher code coverage, we design and implement a stateful protocol fuzzer, yFuzz , to explore the code related to different protocol states. yFuzz is built on AFL (a mainstream greybox fuzzer), and incorporates a stateful fuzzer (which contains a state switching engine) together with a multi-state forkserver (which enables multi-state program forking) to consistently and flexibly fuzz different states of a compiler-instrumented protocol program. Our experimental results on OpenSSL show that yFuzz improves the code coverage by 73% and increases the number of identified unique crashes by 100% when comparing against AFL fuzzing the first packet during a protocol handshake.

show abstract

CustomPro: Network Protocol Customization Through Cross-Host Feature Analysis

Cited by 3 publications

References 35 publications

Verify-Pro: A Framework for Server Authentication using Communication Protocol Dialects

Verify-Pro: A Framework for Server Authentication using Communication Protocol Dialects

Hunting Garbage Collection Related Concurrency Bugs through Critical Condition Restoration

Exploring Effective Fuzzing Strategies to Analyze Communication Protocols

Contact Info

Product

Resources

About