Fuzzing Approach Guided by the Features of Vulnerabilities for Power Industrial Control Protocols

The fuzzing approach has become a practical tool for mining vulnerabilities in Power Industrial Control Systems (PICS), especially in general-purpose communication protocols. Traditional fuzzers often lack domain-specific guidance, resulting in low input validity and limited protocol state exploration. To overcome these limitations, a fuzzing approach guided by the features of vulnerabilities is introduced for mining vulnerabilities in PICS. Vulnerability features are extracted from Common Vulnerabilities and Exposures (CVEs) to guide seed prioritization and mutation strategies. This design increases the relevance of generated inputs and enhances the likelihood of triggering both known and unknown vulnerabilities. Compared to the method of American Fuzzy Lop (AFL), our approach show a 60 % - 66 % reduction in time-to-bug and a <tex xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">$\mathbf{7 1 \% - 8 2 \%}$</tex> reduction in cycles-tobug, while maintaining or improving trigger success rates. Results confirm the approach's effectiveness and generalizability across both domain-specific and general-purpose fuzzing tasks.