RSAFL: Guide protocol fuzzing by runtime state data

Zhang, Shuai

doi:10.1016/j.cose.2026.105055

RSAFL: Guide protocol fuzzing by runtime state data

2026-07-01

0

PRE

AI

DOI：10.1016/j.cose.2026.105055

Original

Original request for help

Save

Abstract

En 中文

Stateful network protocol implementations are prone to security vulnerabilities due to their complex, state-dependent logic, making efficient detection of such flaws a critical challenge. Existing state-aware fuzzing methods either rely on explicit protocol features-limiting their applicability-or process memory data indiscriminately, introducing noise that reduces accuracy. To address these limitations, this paper proposes a runtime state data-guided fuzzing approach that refines state inference through preprocessing and multi-dimensional feature extraction. Our method first filters irrelevant noise from runtime snapshots, then characterizes protocol states using structural patterns, semantic keywords, and discrete tokens. A tailored state distance metric quantifies differences between states, enabling precise clustering and the dynamic construction of a high-fidelity state machine. We implement this approach in RSAFL, a gray-box fuzzer that integrates lightweight feature extraction and state modeling. Evaluated on 11 widely used protocol implementations, RSAFL achieves better results against six state-of-the-art fuzzers, demonstrating its practical effectiveness in exploring deep state spaces and uncovering hidden security flaws.

Keywords:

Protocol fuzzing

Stateful testing

Runtime data

RSAFL: Guide protocol fuzzing by runtime state data

Abstract

Journal

Organization

Cited Papers