HSPFuzzer: High-Speed Network Protocol Fuzzing With Connection Reuse

Fuzzing is a fundamental technique for detecting vulnerabilities in network protocols. However, existing approaches suffer from low fuzzing throughput caused by the overhead associated with server under test (SUT) restarts and connection setup. In this paper, we present HSPFuzzer, a High-Speed Protocol Fuzzer that leverages connection reuse to reduce SUT restarts and connection re-establishments. To enable efficient connection reuse, it incorporates a prefix message identification algorithm to determine the essential packets required within a connection and a coverage monitoring mechanism to detect abnormal execution states. Additionally, HSPFuzzer employs an innovative message provision method that ensures input messages are delivered to the SUT with minimal delay within the same connection. HSPFuzzer also eliminates the need for manually implementing message-splitting logic by connection reuse. We evaluate HSPFuzzer on 12 widely used servers and experimental results show that HSPFuzzer achieves fuzzing throughput 1062× faster than AFLNet, whereas other state-of-the-art fuzzers, including AFLNet, SnapFuzz, HNPFuzzer, and AFL++, achieve, at most, a 12× speedup over AFLNet. Furthermore, HSPFuzzer attains an average code coverage increase of 25.1% compared to AFLNet, while competing fuzzers achieve, at most, 2.13% more coverage. Notably, HSPFuzzer also discovers more vulnerabilities, which further proves its effectiveness.