论文标题
SNPSFUZZER：使用快照的快速灰色盒子Fuzzer用于状态网络协议
SNPSFuzzer: A Fast Greybox Fuzzer for Stateful Network Protocols using Snapshots
论文作者
论文摘要
Greybox Fuzzing已被广泛用于无状态程序，并取得了巨大的成功。但是，在模糊状态网络协议程序的过程中，大多数最先进的Greybox Fuzzer通常都有慢速和浅层状态深度覆盖的问题，该程序能够记住并存储交互的详细信息。现有的网络协议程序的现有灰箱爆炸程序首先发送一系列定义明确的输入消息前缀序列，然后发送突变的消息以测试状态网络协议的目标状态。上面提到的过程导致高时间成本。在本文中，我们提出了SNPSFUZZER，这是一种使用快照的快速灰色盒子Fuzzer，用于状态网络协议。当网络协议程序处于特定状态时，SNPSFUZZER会转储上下文信息，并在需要模糊状态时恢复它。此外，我们设计了一种消息链分析算法，以探索更多更深层次的网络协议状态。我们的评估表明，与最先进的网络协议Greybox Fuzzer Aflnet相比，SNPSFUZZER将网络协议的速度提高了112.0％-168.9％，并在24小时内将路径覆盖率提高了21.4％-27.5％。此外，Snpsfuzzer在程序TinyDTL中暴露了以前未报告的漏洞。
Greybox fuzzing has been widely used in stateless programs and has achieved great success. However, most state-of-the-art greybox fuzzers generally have the problems of slow speed and shallow state depth coverage in the process of fuzzing stateful network protocol programs which are able to remember and store details of the interactions. The existing greybox fuzzers for network protocol programs send a series of well-defined prefix sequences of input messages first and then send mutated messages to test the target state of a stateful network protocol. The process mentioned above causes a high time cost. In this paper, we propose SNPSFuzzer, a fast greybox fuzzer for stateful network protocol using snapshots. SNPSFuzzer dumps the context information when the network protocol program is under a specific state and restores it when the state needs to be fuzzed. Furthermore, we design a message chain analysis algorithm to explore more and deeper network protocol states. Our evaluation shows that, compared with the state-of-the-art network protocol greybox fuzzer AFLNET, SNPSFuzzer increases the speed of network protocol fuzzing by 112.0%-168.9% and improves path coverage by 21.4%-27.5% within 24 hours. Moreover, SNPSFuzzer exposes a previously unreported vulnerability in program Tinydtls.
