SymFL-Net: Branch Information Enhanced Network Protocol Fuzzing

Fuzzing is widely used to test network protocols' reliability. However, network protocol implementations contain numerous branches dedicated to processing network packets, which require certain values at certain positions of the network packet to satisfy, as opposed to simply falling within a range. This makes it challenging for fuzzing to generate testcases that satisfy these branch constraints, leading to inefficiencies in exploring the test space. The challenge is how to generate testcases that can satisfy these branch conditions so that fuzzing can explore the test space more completely. To address this, we introduce a fuzzing approach, SymFL-Net, which is enhanced with branch information. Based on dynamic symbolic execution, we designed a method to extract branch information and generate high-quality testcases with high quality. During testing, SymFL-Net parallelly runs fuzzing and symbolic execution and shares testcases between them, which can help improve the efficiency of exploring test space. We implemented SymFL-Net and evaluated its performance on 5 real-world programs. The experimental results demonstrate at least 89.46 % improvement in average path discovery compared to AFLNet and StateAFL, showing the significant ability of SymFL-Net.