Leveraging Textual Specifications for Grammar-based Fuzzing of Network Protocols
Grammar-based fuzzing is a technique used to find software vulnerabilities by injecting well-formed inputs generated following rules that encode application semantics. Most grammar-based fuzzers for network protocols rely on human experts to manually specify these rules. In this work we study automated learning of protocol rules from textual specifications (i.e. RFCs). We evaluate the automatically extracted protocol rules by applying them to a state-of-the-art fuzzer for transport protocols and show that it leads to a smaller number of test cases while finding the same attacks as the system that uses manually specified rules.
Code (0)
등록된 구현이 없습니다.
Similar Papers 제목 키워드 기반
Synthesizing Precise Protocol Specs from Natural Language for Effective Test Generation
Safety- and security-critical systems have to be thoroughly tested against their specifications. The state of practice is to have _natural language_ specifications, from which test cases are derived manually - a process …
MultiFuzz: A Dense Retrieval-based Multi-Agent System for Network Protocol Fuzzing
Traditional protocol fuzzing techniques, such as those employed by AFL-based systems, often lack effectiveness due to a limited semantic understanding of complex protocol grammars and rigid seed mutation strategies. Rece…
KernelGPT: Enhanced Kernel Fuzzing via Large Language Models
Bugs in operating system kernels can affect billions of devices and users all over the world. As a result, a large body of research has been focused on kernel fuzzing, i.e., automatically generating syscall (system call)…
validExplainFuzz: Explainable and Constraint-Conditioned Test Generation with Probabilistic Circuits
Understanding and explaining the structure of generated test inputs is essential for effective software testing and debugging. Existing approaches--including grammar-based fuzzers, probabilistic Context-Free Grammars (pC…
R1-Fuzz: Specializing Language Models for Textual Fuzzing via Reinforcement Learning
Fuzzing is effective for vulnerability discovery but struggles with complex targets such as compilers, interpreters, and database engines, which accept textual input that must satisfy intricate syntactic and semantic con…
Reinforcement Learning