SVRM: Composing Various Network Service Fuzzing Corpus with One Single Model

Discovering vulnerabilities in network service is of great significance. Currently, coverage-guided fuzzing (CGF) is widely regarded as the most effective method. However, the efficiency of CGF depends on the quality of initial corpus. The initial corpus is a set of valid input examples used to initiate the fuzzing process. Constructing high-quality initial corpus typically requires manual efforts to understand the implementation details and corresponding protocol specifications, making it difficult to generalize across different protocol implementations.To generate high-quality corpus tailored to service under test (SUT), this paper proposes a protocol-independent smart generation method. The paper introduces a novel service communication model and utilizes active learning algorithms to automatically construct the model. By analyzing the minimum spanning tree of the model, we achieve automatic generation of high-quality corpus that adapts to the SUT.We conduct experiment by generating adaptive corpus for 6 targets of 6 different protocols in ProFuzzBench. Compared to the corpus provided by ProFuzzBench, the corpus generated by our system improve the state coverage of modern protocol fuzzers by 37.1% and discover known real protocol vulnerabilities at a speed 2.47x faster.