Leveraging Textual Specifications for Grammar-based Fuzzing of Network Protocols

TL;DR

This paper presents an automated method to learn network protocol rules from textual specifications like RFCs, enhancing grammar-based fuzzing by reducing manual effort while maintaining effectiveness in vulnerability detection.

Contribution

It introduces an automated approach to extract protocol rules from textual specs, improving fuzzing efficiency without sacrificing attack discovery capabilities.

Findings

Automated rules lead to fewer test cases.

Maintains same attack detection as manual rules.

Reduces manual effort in fuzzing setup.

Abstract

Grammar-based fuzzing is a technique used to find software vulnerabilities by injecting well-formed inputs generated following rules that encode application semantics. Most grammar-based fuzzers for network protocols rely on human experts to manually specify these rules. In this work we study automated learning of protocol rules from textual specifications (i.e. RFCs). We evaluate the automatically extracted protocol rules by applying them to a state-of-the-art fuzzer for transport protocols and show that it leads to a smaller number of test cases while finding the same attacks as the system that uses manually specified rules.