Detecting the vulnerability of software with cyclic behavior using Sulley

Sulley, one of fuzzing tools can describe Software Under Test (SUT) more easily than other tools and provides with the libraries which can create the variety of test cases. But it has a weak point of difficulty to verify the vulnerability at the actual software because it doesn't consider the process of the cycle between nodes. This paper carries out the research to resolve such problem so that it enables for Sulley to fuzz software with cycle. The basic structure and algorithm of Sulley are extended to adopt the requirement. We modify the structure of software excluding the cycle of software using the unfolding technique, which is widely used for the process of the loop structure in software field. The cycle structure is unfolded hiring the concept of boundary-interior path coverage. To evaluate the suggested method, fuzzing test is performed against the FTP service modeled by Sulley. The feasibility of the suggested method is proved by finding errors of the FTP service with cyclic behavior, which is being used widely.