Learning-Guided Fuzzing for Testing Stateful SDN Controllers

SeqFuzzSDNAbstractControllers for software-defined networks (SDNs) are centralised software components that enable advanced network functionalities, such as dynamic traffic engineering and network virtualisation. However, these functionalities increase the complexity of SDN controllers, making thorough testing crucial. Unlike traditional network components (e.g., switches), SDN controllers are stateful, maintaining a holistic view of the network and interacting with multiple network devices through sequences of control messages. Identifying stateful failures in an SDN controller is challenging due to the infinite possible sequences of control messages, which result in an unbounded number of stateful interactions between the controller and network devices.In this article, we propose SeqFuzzSDN, a learning-guided fuzzing method for testing stateful SDN controllers.SeqFuzzSDN aims to:efficiently explore the state space of the SDN controller under test,generate effective and diverse tests (i.e., control message sequences) to uncover failures, andinfer accurate failure-inducing models that characterise the sequences of control messages leading to failures.In addition, we compare SeqFuzzSDN with three extensions of state-of-the-art (SOTA) methods for fuzzing SDNs, as none of them are directly comparable to SeqFuzzSDN.Our findings show that, compared to the extended SOTA methods, SeqFuzzSDN (1) generates more diverse message sequences (i.e., diverse stateful behaviours) that lead to failures within the same time budget, and (2) produces more accurate failure-inducing models, significantly outperforming the other extended SOTA methods in terms of sensitivity.PrerequisiteIn order to build and install SeqFuzzSDN, the following tools are required:Python &gt;= 3.9Maven &gt;= 3.9Java JDK &gt;= 11MininetBuildThe source codes of the SeqFuzzSDN are implemented using Python3.9+ and Java11+. They can be compiled on any Linux distribution that supports Python3.9+ and Java11+, and the dependency libraries cited above.To compile the sources, the following steps are required:```bash$ cd src/leafsdn$ git clone$ make clean build```<br>After compilation, the python wheel of the application and the jar file of the fuzzer will be available under the folder`/dist/`.DeployTo install the application and the fuzzer, run the following command:```bash$ make deploy```The executable files will be installed under the folder `$XDG_HOME_BIN` (By default `~/.local/bin`).The configuration files will be installed under the folder `$XDG_CONFIG_HOME` (By default `~/.config`).UsageTo run a fuzzing campaign```bashusage: leafsdn run [-h] [--list-scenarios] [--failure FAILURE] [--log-level {trace,debug,info,warning,error}] [--fuzzer-jar-path FUZZER_JAR_PATH] [--fuzzer-socket-address FUZZER_SOCKET_ADDRESS] [--resume ITERATION PHASE]name {onos} scenario iterations exec_per_iter<br>Run fuzzing experiments on SDN controllers<br>positional arguments:name Name of the campaign to run{onos} Name of the controller to use for the campaignscenario Name of the scenario to run for the experiment. Run "leafsdn run --list-scenarios" to list the available scenarios.iterations Number of iterations to run for the experimentexec_per_iter Number of executions per iteration to run for the experiment<br>optional arguments:-h, --help Show this help message and exit--list-scenarios List the available scenarios and exit--failure FAILURE, -f FAILUREWhich failure to focus in the campaign. Default is `None`.--log-level {trace,debug,info,warning,error}Set the log level--fuzzer-jar-path FUZZER_JAR_PATHOverride the path to the fuzzer jar file--fuzzer-socket-address FUZZER_SOCKET_ADDRESSOverride the socket address of the fuzzer.--resume ITERATION PHASEResume the experiment from the specified iteration and phase```<br>2. To evaluate a fuzzing campaign```bashusage: leafsdn evaluation [-h] [--if-summary-exists] [--skip-plot [...]] campaign<br>Evaluate a fuzzing campaign from SeqFuzzSDN<br>positional arguments:campaign Name of the campaign to evaluate<br>optional arguments:-h, --help show this help message and exit--if-summary-exists What to do if the campaign has already been evaluated. Valid options are "update", "skip", or "error". Default is "error".--skip-plot [ ...] Skip the evaluation of certain parts of the campaign. Allowed values are "all" or any of the following: "data_models_performance", "efsm_sensitivity", "entropy_of_efsm_state_exercises", "error_rate", "pareto_front","traces_diversity_increase"```---<br>## Data Availability<br>The raw data that were generated during the experiments are not available in this artifact due to their large size (over 100GB, compressed).The treated data are however available in this artifact. To access those data or re-run the evaluation, extract the <b><i>empirical</i></b> folder under the same folder as SeqFuzzSDN.To access the raw data, please contact the authors of SeqFuzzSDN.