A method for fuzz testing stateful network protocols

By building an initial test case library and using the exp3 algorithm to select important states, combined with a genetic algorithm to evaluate the fitness of test cases, the inefficiency of state selection and case selection in traditional fuzz testing is solved, achieving more efficient fuzz testing and vulnerability discovery.

CN118740482BActive Publication Date: 2025-10-14UNIV OF SCI & TECH OF CHINA
1 Cites 0 Cited by

Patent Information

Application Number
CN202410981966.1
Authority / Receiving Office
CN · China
Patent Type
Patents(China)
Current Assignee / Owner
Filing Date
2024-07-22
Publication Date
2025-10-14
Estimated Expiration
2044-07-22

AI Technical Summary

Technical Problem

Traditional stateful network protocol fuzz testing methods suffer from inefficiency and insufficient vulnerability discovery capabilities in the state selection, test case selection, and retention processes, mainly due to the single evaluation state information, the lack of an effective state selection algorithm, and over-reliance on code coverage.

Method used

A state selection algorithm is used to construct the initial test case library. Important states are selected through a customized exponential weight algorithm (exp3). The test case fitness is evaluated in combination with a genetic algorithm. The state coverage, code coverage and number of state transitions are comprehensively considered to guide the fuzz testing process.

Benefits of technology

The efficiency and vulnerability mining capabilities of fuzz testing are improved. By evaluating states and test cases in multiple dimensions, state selection and case retention are optimized, redundancy is reduced, and the effectiveness and efficiency of testing are improved.

✦ Generated by Eureka AI based on patent content.
Patent Text Reader

Abstract

The application discloses a kind of stateful network protocol-oriented fuzz testing method, constructs the corpus of initial test case, and carries out compiling and inserting plug-in operation;Through state selection algorithm, the target state of each round of fuzz testing is selected;From the test case set, the corresponding test case queue is selected, then a test case is selected from the test case queue to generate new test case by variation operation, then the new test case is sent to network protocol server to carry out fuzz testing;After a round of fuzz testing is completed in network protocol server, the feedback information of network protocol server is collected, including code coverage, state coverage and state transition, and subsequent fuzz testing process is guided according to feedback information.The above-mentioned method can solve the problems existing in state selection, test case scheduling and other aspects of traditional network protocol fuzz testing, improve network protocol fuzz testing efficiency and vulnerability mining capability.
Need to check novelty before this filing date? Find Prior Art