Source-linked AI summary
StateAFL: Greybox Fuzzing for Stateful Network Servers
Roberto Natella
TL;DR
Stateful network-server fuzzing is difficult because server behavior depends on message sequences, while existing techniques require costly protocol-specific artifacts. StateAFL uses compile-time instrumentation and fuzzy hashing of long-lived memory to infer protocol states without manual customization. Across network-server benchmarks, it matched or exceeded protocol-customized fuzzing in coverage and vulnerability detection, while memory-based states better reflected server behavior than response codes.
Problem
Stateful network-server fuzzing is difficult because server behavior depends on message sequences, while existing approaches require manual protocol models, parsers, or learning wrappers.
Method
StateAFL instruments network servers at compile time, snapshots long-lived memory, and applies fuzzy hashing to infer protocol states for coverage-guided fuzzing.
Results
StateAFL matched or exceeded protocol-customized fuzzing in code coverage and vulnerability detection across network-server benchmarks.
Takeaways & Limitations
Memory-inferred states can better reflect server behavior than response codes, which may represent only the last request and inflate the inferred state machine.
Takeaways & Limitations
StateAFL may fail to identify new states for highly structured binary protocols such as OpenSSL, while nondeterministic memory variation can produce redundant state identifiers.
Abstract
from arXiv · showhide
Fuzzing network servers is a technical challenge, since the behavior of the target server depends on its state over a sequence of multiple messages. Existing solutions are costly and difficult to use, as they rely on manually-customized artifacts such as protocol models, protocol parsers, and learning frameworks. The aim of this work is to develop a greybox fuzzer (StateaAFL) for network servers that only relies on lightweight analysis of the target program, with no manual customization, in a similar way to what the AFL fuzzer achieved for stateless programs. The proposed fuzzer instruments the target server at compile-time, to insert probes on memory allocations and network I/O operations. At run-time, it infers the current protocol state of the target server by taking snapshots of long-lived memory areas, and by applying a fuzzy hashing algorithm (Locality-Sensitive Hashing) to map memory contents to a unique state identifier. The fuzzer incrementally builds a protocol state machine for guiding fuzzing. We implemented and released StateaAFL as open-source software. As a basis for reproducible experimentation, we integrated StateaAFL with a large set of network servers for popular protocols, with no manual customization to accomodate for the protocol. The experimental results show that the fuzzer can be applied with no manual customization on a large set of network servers for popular protocols, and that it can achieve comparable, or even better code coverage and bug detection than customized fuzzing. Moreover, our qualitative analysis shows that states inferred from memory better reflect the server behavior than only using response codes from messages.
1 Introduction
StateAFL addresses the difficulty of fuzzing stateful network servers by inferring protocol states from instrumented process memory rather than requiring protocol-specific customization. It is released and evaluated across diverse servers, where it achieves comparable or better coverage and bug detection than customized approaches.
- Motivation: Stateful network servers are difficult to fuzz because behavior and vulnerabilities depend on sequences of messages governed by protocol state.Network protocols restrict which messages and actions are valid at each point in a session.
- Motivation: Existing stateful fuzzers require costly manual artifacts, including protocol specifications, message parsers, or customized learning wrappers.These requirements have limited the broader adoption of stateful protocol fuzzing.
- Approach: StateAFL uses compile-time instrumentation, memory and network-I/O tracking, long-lived-memory snapshots, and Locality-Sensitive Hashing to infer protocol-state identifiers.The approach avoids deriving state solely from network messages and does not require custom message parsers.
- Evaluation: StateAFL was released as open-source software and integrated with a public benchmark of 13 open-source network servers without manual protocol customization.The integration supports reproducible experimentation across diverse network-server targets.
- Evaluation: StateAFL achieved comparable or better code coverage and bug detection than stateless and protocol-customized fuzzing solutions.The evaluation also included performance measurements and qualitative analysis of inferred protocol states.
- Evaluation: Response-code-derived states can misrepresent protocol state, producing redundant states and wasted fuzz inputs.The paper identifies this as a limitation of message-based state inference.
2 Related work
Prior stateful fuzzing approaches depend on protocol models, learning machinery, or protocol-specific parsers, limiting automation and portability. StateAFL instead infers protocol states through compile-time instrumentation and richer target feedback than response codes alone.
- Model-based and learning-based fuzzing: Generation-based fuzzers require human analysts to provide protocol models describing message formats and sequencing.These models encode both message structure and session ordering.
- Model-based and learning-based fuzzing: Passive and active learning techniques assist analysts but do not fully automate protocol-model construction.Active learning can face convergence issues and requires an ad-hoc mapper tailored to the system under test.
- Model-based and learning-based fuzzing: Static and dynamic binary-analysis solutions aim for automation but are difficult to implement and port across systems.These portability difficulties limit their adoption.
- Coverage-driven fuzzing: Coverage-driven fuzzing offers a more practical automated approach by collecting lightweight runtime feedback and mutating inputs to maximize it.AFL and related tools use feedback such as covered code blocks and branches.
- Coverage-driven fuzzing: AFLnet extends coverage-driven fuzzing with message-level mutations and protocol-state learning based on response codes.Its state representation depends on extracting protocol-specific response information.
- StateAFL: StateAFL infers protocol states from compile-time instrumentation and richer system feedback, avoiding response-code dependence and custom message parsers.This addresses protocols whose responses poorly indicate state or lack response codes entirely.
3 Proposed approach
StateAFL infers protocol states from long-lived memory across request-reply iterations and uses those states, together with code coverage, to guide greybox fuzzing. Compile-time probes track allocations and network I/O, while fuzzy hashing maps memory snapshots to state identifiers for state-machine construction and input selection.
- Fundamental server loop: StateAFL models a session as repeated request-reply iterations in which the server’s protocol state evolves.The loop receives a request, processes it using long-lived and short-lived data, sends a reply, and deallocates short-lived data.
- Memory-based state inference: The fuzzer infers protocol states from snapshots of long-lived memory taken at the end of each request-reply exchange.Long-lived data persists across a session and can encode information such as authentication status, working directory, or queued inputs.
- Fuzzing guidance: StateAFL combines protocol-state feedback with code coverage to prioritize previous inputs, mutation locations, mutation operators, and target states.It selects a state, identifies an input that reached it, and mutates the message sent from that state.
- Scope and execution: The design requires target-server source code and focuses on TCP/IP client-server communication, leaving multiparty protocols outside its scope.StateAFL compiles and instruments the target source before exchanging fuzz-input messages with the server over TCP/IP.
- Instrumentation probes: Compile-time probes track memory allocation, deallocation, and network send and receive operations to collect protocol-state feedback.The probes are inserted into the target server and update StateAFL’s internal iteration-tracking state machine.
- State identification: Locality-Sensitive Hashing assigns memory snapshots protocol-state identifiers while reducing redundant states caused by small execution-dependent memory variations.The distance threshold is calibrated from repeated seed executions and can be increased when new states appear for five consecutive fuzz inputs.
4 Experimental plan
The evaluation compares StateAFL with two broadly applicable greybox network fuzzers on a diverse benchmark, measuring coverage, crashes, state-inference quality, and execution overhead. It also tests whether StateAFL can run across network servers without protocol customization.
- Research questions: The experiments assess code coverage and target crashes as indicators of fuzzing depth and potential security-issue discovery.These measures address how StateAFL compares with state-of-the-art network fuzzing.
- Research questions: State-inference accuracy is examined qualitatively because protocol state machines depend on each server implementation and lack a general ground truth.The analysis checks whether inferred states are nonredundant and reflect expected behavior, comparing StateAFL with custom protocol-specific state machines.
- Research questions: Performance is evaluated through the execution slowdown caused by instrumentation, while StateAFL’s applicability is tested across targets without protocol customization.The evaluation comprises 156 experiments: four repetitions for each of 13 targets and three fuzzers.
- Benchmark and setup: The benchmark contains 13 open-source network servers covering 10 protocols, C and C++, TCP and UDP, binary and text formats, and varied APIs.The benchmark is integrated through ProFuzzBench to support reproducible experimentation.
- Baseline fuzzers: The evaluation compares StateAFL with AFLnwe and AFLnet, which represent pure coverage-driven and response-code-based stateful greybox fuzzing.AFLnwe mutates byte streams using AFL’s coverage analysis, while AFLnet mutates message sessions and associates messages with response-derived states.
- Applicability: StateAFL ran successfully on every target without protocol customization, although Forked-daapd required configuring two libevent APIs to track its request/reply loop.The standard C-library network I/O APIs are instrumented automatically; no StateAFL modification was needed for the libevent configuration.
5 Experimental results
Across the benchmark, StateAFL achieved coverage comparable to or better than competing fuzzers and found the same or more crashes without protocol customization. Its memory-based state inference produced smaller, behaviorally meaningful state machines and avoided redundant fuzzing, although input generation limited results for highly structured protocols.
- Coverage and vulnerabilities: After 24 hours, StateAFL and AFLnet matched or exceeded AFLnwe coverage on the benchmark, with larger gains for LightFTP, Exim, and TinyDTLS.Six targets had similar coverage across fuzzers; stateful fuzzers achieved higher coverage on the other seven.
- Coverage and vulnerabilities: Stateful fuzzing improved coverage on targets where server behavior depended on inferred state, while stateless fuzzing could eventually catch up when behavior was driven mainly by the current input.StateAFL uses newly discovered states and their preceding messages as starting points for generating further inputs.
- Coverage and vulnerabilities: StateAFL found the same crashed targets as AFLnwe and AFLnet and uniquely found a ProFTPD heap buffer over-read.All reported crashes were found within one hour; StateAFL triggered the ProFTPD bug by stressing and fragmenting the custom memory allocator.
- Protocol state inference: For LightFTP, memory snapshots and locality-sensitive hashing recognized unchanged states, clustered execution-dependent contents, and limited redundant state growth.PORT and LIST commands produced varying long-lived data, which hashing grouped into a small number of inferred states.
- Protocol state inference: Status-code-based inference can create redundant states because response codes describe only the latest command, whereas memory reflects accumulated server side effects.AFLnet therefore explored multiple apparently distinct states that produced the same behavior, wasting fuzzing attempts.
- Protocol state inference: StateAFL inferred fewer, more reference-like states than AFLnet across all four FTP servers.Different implementations covered different protocol subsets, but StateAFL's inferred machines consistently had fewer states and were closer to the reference model.
- Protocol state inference: StateAFL produced only a dummy state and one fixed state for Kamailio and OpenSSL, revealing a limitation when state does not change or valid binary-protocol sequences are hard to generate.The authors identify structure-aware fuzzing as a possible way to address the OpenSSL input-generation limitation.
- Performance: Instrumentation overhead was usually small relative to target execution, but post-execution hashing caused noticeable slowdown for fast targets with larger long-lived memory.Hash computation ranged from fractions of a millisecond to about 100 ms.
6 Conclusion
StateAFL infers protocol states from snapshots of long-lived memory using fuzzy hashing, avoiding manual protocol customization. Evaluation found comparable or better coverage and vulnerability detection than protocol-custom fuzzing, while identifying response codes as potentially poor state indicators and highlighting future research directions.
- Approach: StateAFL uses compile-time probes and fuzzy hashing of long-lived memory snapshots to infer protocol states without manual protocol customization.The inferred state identifiers support stateful fuzzing of network servers.
- Evaluation: StateAFL matched protocol-custom fuzzing in code coverage and vulnerability detection, and exceeded it for some targets with limited execution overhead.The system was released as open-source software and evaluated on a benchmark of network servers.
- State representation: Response codes may reflect only the last request rather than the server’s current state, inflating state machines and causing redundant fuzz tests.Memory-based state knowledge can help the fuzzer avoid those redundant tests.
- Future work: Future work includes memory-based state inference, state-selection and input-mutation heuristics, binary-only programs, and applications beyond network protocols.The paper identifies these as directions for extending stateful fuzzing.