NSFuzz: Towards Efficient and State-Aware Network Service Fuzzing

Abstract

As the essential component responsible for communication, network services are security-critical, and it is vital to find v u lnerabilities i n t h em. F u zzing i s c u rrently o n e o f the most popular software vulnerability discovery techniques, widely adopted due to its high efficiency and low false positives. However, existing coverage-guided fuzzers mainly aim at stateless local applications, leaving stateful network services underexplored. Recently, some fuzzers targeting network services have been proposed but have certain limitations, e.g., insufficient o r inaccurate state representation and low testing efficiency.In this paper, we propose a new fuzzing solution NSFuzz for stateful network services. Specifically, w e s t udied t y pical implementations of network service programs and figured o u t how they represent states and interact with clients, and accordingly propose (1) a program variable-based state representation scheme and (2) an efficient i n teraction s y nchronization m e chanism to improve efficiency. We have implemented a prototype of NSFuzz, which uses static analysis to identify network event loops and extract state variables, then achieves fast I/O synchronization and efficient s t ate-aware f u zzing v i a l i ghtweight compile-time instrumentation. The preliminary evaluation results show that, compared with state-of-the-art network service fuzzers AFLNET and STATEAFL, our solution NSFuzz could infer a more accurate state model during fuzzing and improve the testing throughput by up to 50x and the coverage by up to 20%.

Large Language Model guided Protocol Fuzzing

“…Our results for all text-based protocols in the PRO-FUZZBENCH protocol fuzzer benchmark [33] demonstrate the effectiveness of the LLM-guided approach: Compared to the baseline (AFLNET [36]) into which our approach was implemented, our tool CHATAFL covers almost 50% more state transitions, 30% more states, and 6% more code. CHATAFL shows similar improvements over the state-of-the-art (NSFUZZ [38]). In our ablation study, starting from the baseline we found that enabling (i) the grammar extraction, (ii) the seed enrichment, and (iii) the saturation handler one by one allows CHATAFL to achieve the same code coverage 2.0, 4.6, and 6.1 times faster, respectively, as the baseline achieves in 24 hours.…”

“…A mutation-based protocol fuzzer [36], [38] uses a set of pre-recorded message sequences as seed inputs for mutation. The recording ensures that the message structure and order are valid while mutational fuzzing will slightly corrupt both [36].…”

“…The recording ensures that the message structure and order are valid while mutational fuzzing will slightly corrupt both [36]. In fact, all recently proposed protocol fuzzers, such as AFLNET [36] and NSFUZZ [38] follow this approach.…”

“…LIVE555 implements RTSP in accordance with RFC 2326, functioning as a streaming server in entertainment and communications systems to manage streaming media servers. It is included in PROFUZZBENCH, a widely-used benchmark for stateful fuzzers of network protocols [36], [7], [38]. PRO-FUZZBENCH comprises a suite of representative open-source network servers for popular protocols, with LIVE555 being among them.…”

“…Mutation-based protocol fuzzing reduces the dependence on a machine-readable specification of that required message structure or order by fuzzing recorded message sequences [36], [38], [7], [32]. The simple mutations often preserve the required protocol while still corrupting the message sequences enough to expose errors.…”