EvoFuzz: Enhancing State Space Exploration and Seed Prioritization in Stateful Protocol Fuzzing Using Evolutionary Game Theory
摘要
Stateful Coverage-Based Greybox Fuzzing (SCGF) is a key technique for securing stateful network protocols. To efficiently process feedback and guide mutations, these fuzzers predominantly employ scheduling strategies based on simple short-term heuristics. However, the reliance on myopic heuristics, which fail to adopt a global, long-term optimization perspective, results in inefficient state-space exploration and a struggle to uncover vulnerabilities requiring deep and complex state transitions. To address this issue, we present EvoFuzz, an adaptive scheduling framework that applies Evolutionary Game Theory (EGT). EvoFuzz operates through two core modules: EvoState and EvoSeed. The EvoState module treats states as competing players to guide global exploration, while the EvoSeed module treats candidate seeds as competing players, selecting the most promising one within a target state. We implemented EvoFuzz on top of NSFuzz and evaluated it on five real-world protocols. The results indicate that compared to the state-of-the-art baselines, EvoFuzz increases the unique state sequence by up to 205.56%, increases code branch coverage by up to 6.87%, and increases the number of unique crashes by 31.96%.