Fuzz Testing of Stateful Network Protocols Based on Multi-Armed Bandit Variant

As the foundation of network communication, the security of network protocols cannot be ignored. Therefore, it is crucial to discover their vulnerabilities in time. Fuzzing, an efficient software vulnerability discovery technique, has been widely used in the industry due to its high efficiency and low false positives. In recent years, several fuzzers for stateful network protocols have been proposed. But they are faced with the following challenges: (1) when evaluating and selecting states, there is a tendency to rely on information from a single dimension, such as code coverage, which can lead to a failure to identify critical test states; (2) the lack of an effective state selection algorithm leads to the possibility that the fuzzer may spend a significant amount of time testing meaningless states, thus reducing the efficiency of testing; (3) seed selection and retention rely too much on code coverage, while ignoring other state information, making it difficult to select and retain high-quality seeds. In this paper, we propose a gray-box fuzzing method for stateful network protocols, which guides the fuzzing process based on the information of path coverage, state coverage, and number of state transitions. We also introduce the AR-SMAB model to guide the state selection process. We implemented our testing tool and compared it with other stateful fuzzers. Our experiments show that our tool is more effective in discovering paths, improving by approximately 10% to 15% compared to other tools. Our tool also can find more crashes, improving by approximately 30% to 35% compared to other tools. In addition, our tool is similar to AFLNET in terms of execution efficiency, ensuring an efficient performance.