Large Language Model guided State Selection Approach for Fuzzing Network Protocol

Fuzzing network protocols is challenging due to their various factors including protocol state and state transitions. To achieve better state coverage when fuzzing network protocol with grey-box fuzzing, several approaches are proposed to select valuable states and optimize the fuzzing process. Based on the ability of extensive knowledge integration and reasoning, large language models (LLMs) are also imported to generate more effective test cases for protocol fuzzing. However, these approaches leave poor state and code coverage on real-world services protocol evaluation since they use either random selection or heuristics. To address this issue, we present LLMgSSA, a Large Language Model guided State Selection Approach, which navigates the LLM to reason about protocol state selection. In the approach, LLMgSSA first extracts the features of the current protocol and state space and determines valuable states by interacting with the LLM. It then collects and analyzes the current status of each covered state and combines the inference results of the LLM for the final state selection. To evaluate the effectiveness of LLMgSSA, we have conducted extensive experiments with five real-world protocols from ProFuzzBench. Experimental results show that, compared to three state-of-the-art fuzzers, ChataFL, AFLnet, and NSFuzz, LLMgSSA can increase state transitions, covered states, branch coverage, and line coverage by up to 70.6%, 35.3%, 13.1%, and 13.1% respectively.