Stateful Coverage-Based Greybox Fuzzing (SCGF) is a key technique for securing stateful network protocols. To efficiently process feedback and guide mutations, these fuzzers predominantly employ scheduling strategies based on simple short-term heuristics. However, the reliance on myopic heuristics, which fail to adopt a global, long-term optimization perspective, results in inefficient state-space exploration and a struggle to uncover vulnerabilities requiring deep and complex state transitions. To address this issue, we present EvoFuzz, an adaptive scheduling framework that applies Evolutionary Game Theory (EGT). EvoFuzz operates through two core modules: EvoState and EvoSeed. The EvoState module treats states as competing players to guide global exploration, while the EvoSeed module treats candidate seeds as competing players, selecting the most promising one within a target state. We implemented EvoFuzz on top of NSFuzz and evaluated it on five real-world protocols. The results indicate that compared to the state-of-the-art baselines, EvoFuzz increases the unique state sequence by up to 205.56%, increases code branch coverage by up to 6.87%, and increases the number of unique crashes by 31.96%.

错误:搜索内容不能为空,请输入英文关键词
错误:关键词超出字数限制,请精简
高级检索

EvoFuzz: Enhancing State Space Exploration and Seed Prioritization in Stateful Protocol Fuzzing Using Evolutionary Game Theory

  • Chengdong Wang,
  • Bo Yu,
  • Lin Yang

摘要

Stateful Coverage-Based Greybox Fuzzing (SCGF) is a key technique for securing stateful network protocols. To efficiently process feedback and guide mutations, these fuzzers predominantly employ scheduling strategies based on simple short-term heuristics. However, the reliance on myopic heuristics, which fail to adopt a global, long-term optimization perspective, results in inefficient state-space exploration and a struggle to uncover vulnerabilities requiring deep and complex state transitions. To address this issue, we present EvoFuzz, an adaptive scheduling framework that applies Evolutionary Game Theory (EGT). EvoFuzz operates through two core modules: EvoState and EvoSeed. The EvoState module treats states as competing players to guide global exploration, while the EvoSeed module treats candidate seeds as competing players, selecting the most promising one within a target state. We implemented EvoFuzz on top of NSFuzz and evaluated it on five real-world protocols. The results indicate that compared to the state-of-the-art baselines, EvoFuzz increases the unique state sequence by up to 205.56%, increases code branch coverage by up to 6.87%, and increases the number of unique crashes by 31.96%.