关键词: 模糊测试, 协议状态机, 协议状态迁移, 中国邮路问题, UIO序列

Abstract:

There are many problems such as repetitive message interaction, blind input and so on in the current protocol fuzzing techniques. This paper presents a fuzzing method based on protocol state migration traversal. The method transforms protocol state migration traversal into a Chinese postman problem, and obtains the shortest path traversing all protocol state transitions. The method then tests each state transition according to the shortest path. In the process of fuzzing, message input is dynamically adjusted through analyzing the response message of protocol entity so as to avoid invalid interaction. In addition, the UIO sequence is used to determine whether the protocol entity state is abnormally migrated or not in order to detect the protocol logic vulnerability in time. Experimental results show that the fuzzing optimization method can significantly improve the fuzzing efficiency and the vulnerability mining ability.

Key words: fuzzing, protocol state machine, protocol state migration, Chinese postman problem, UIO sequence