AFLNET: A Greybox Fuzzer for Network Protocols

By Van-Thuan Pham, Marcel Böhme, Abhik Roychoudhury. International Conference on Information Control Systems & Technologies, 2020

376 citations recorded by the source corpus.

Server fuzzing is difficult. Unlike simple command-line tools, servers feature a massive state space that can be traversed effectively only with well-defined sequences of input messages. Valid sequences are specified in a protocol. In this paper, we present AFLNET, the first greybox fuzzer for protocol implementations. Unlike existing protocol fuzzers, AFLNET takes a mutational approach and uses state-feedback to guide the fuzzing process. AFLNET is seeded with a corpus of recorded message exchanges between the server and an actual client. No protocol specification or message grammars are required. AFLNET acts as a client and replays variations of the original sequence of messages sent to the server and retains those variations that were effective at increasing the coverage of the code or state space. To identify the server states that are exercised by a message sequence, AFLNET uses the server’s response codes. From this feedback, AFLNET identifies progressive regions in the state space, and systematically steers towards such regions. The case studies with AFLNET on two popular protocol implementations demonstrate a substantial performance boost over the state-of the-art. AFLNET discovered two new CVEs which are classified as critical (CVSS score CRITICAL 9.8).

Subfields: Artificial Intelligence, Computer Networks and Communications, Software

View Paper: https://www.semanticscholar.org/paper/6e9ba1b03a8d2d93bb1e55a8226912dd0ec147cc

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

1. Sheng Wen
2. Abhik Roychoudhury
3. Seyit Ahmet Camtepe
4. Marcel Böhme
5. Yang Xiang

In Computer Networks and Communications

1. Sheng Wen
2. Abhik Roychoudhury
3. Seyit Ahmet Camtepe
4. Yang Xiang

In Software

1. Yang Xiang
2. Sheng Wen
3. Seyit Ahmet Camtepe
4. Xiaogang Zhu
5. Marcel Böhme
6. Abhik Roychoudhury
7. Ruijie Meng
8. Martin Mirchev

Citations in the corpus

• A Survey on Large Language Model (LLM) Security and Privacy: The Good, the Bad, and the Ugly (2023, background): “CHATAFL [181] is an LLM-guided protocol fuzzer that constructs grammars for message types and mutates messages or predicts the next messages based on LLM interactions, achieving better state and code coverage compared to state-of-the-art fuzzers (e.g., AFLNET [208], NSFUZZ [213]).”
• Fuzzing: A Survey for Roadmap (2022, background): “If code coverage is not available, an intuitive solution is to retain seeds based on execution outputs, such as the legality of execution results [141] or state machine of protocol implementations [154].”
• Large Language Model guided Protocol Fuzzing (2024, positive): “In fact, all recently proposed protocol fuzzers, such as AFLN ET [36] and NSF UZZ [38] follow this approach.”