Greybox protocol fuzzing is a random testing approach for stateful protocol implementations, where the input is protocol messages generated from mutations of seeds, and the search in the input space is driven by the feedback on coverage of both code and state. State model and message model are the core components of communication protocols, which also have significant impacts on protocol fuzzing. In this work, we propose APFuzz (Automatic greybox Protocol Fuzzer) with novel designs to increase the smartness of greybox protocol fuzzers from the perspectives of both the state model and the message model. On the one hand, APFuzz employs a two-stage process of static and dynamic analysis to automatically identify state variables, which are then used to infer an accurate state model during fuzzing. On the other hand, APFuzz introduces field-level mutation operations for binary protocols, leveraging message structure awareness enabled by Large Language Models. We conduct extensive experiments on a public protocol fuzzing benchmark, comparing APFuzz with the baseline fuzzer AFLNET as well as several state-of-the-art greybox protocol fuzzers.

翻译：灰盒协议模糊测试是一种针对有状态协议实现的随机测试方法，其输入为通过对种子进行变异生成的协议消息，而在输入空间中的搜索则由代码覆盖率和状态覆盖率的反馈所驱动。状态模型和消息模型是通信协议的核心组成部分，它们对协议模糊测试也具有重要影响。在本工作中，我们提出了APFuzz（自动化灰盒协议模糊测试器），通过状态模型和消息模型两个维度的新颖设计来提升灰盒协议模糊测试器的智能化水平。一方面，APFuzz采用静态与动态分析相结合的两阶段流程来自动识别状态变量，进而在模糊测试过程中推断出精确的状态模型。另一方面，APFuzz针对二进制协议引入了字段级变异操作，利用大型语言模型实现的消息结构感知能力。我们在公开的协议模糊测试基准集上进行了大量实验，将APFuzz与基线模糊测试器AFLNET以及多种先进的灰盒协议模糊测试器进行了对比。