Large Language Model Guided Protocol Fuzzing [WIP]

Fuzzing was what greeted me the first when I stepped my foot into the fields of security. The idea of exploring unknown vulnerabilities by seemingly random inputs to some target, such as kernel component, was fascinating to me.

---

Simply put, fuzzing is a technique of discovering vulnerabilities by throwing inputs into a target, and observing whether it crashes. To add some detail, aforementioned inputs are crafted from corpus, which serves as a database for previous inputs; or if it is a new run, randomly generated seeds can be the inputs. The inputs will be tested against the target such as a program or a protocol. Examples of criteria of deciding whether the input was effective are code-coverage (the amount of code that was executed from this input), state-coverage (the amount of states explored), etc.

A fuzzer like BRF, a syzkaller based fuzzer for fuzzing eBPF runtime, generates random eBPF codes as the seeds, mutates them, and selects the corpus with regards of code-coverage.

---

Introduction#

In this paper, the authors¹ targeted mutation-based protocol fuzzing, which is a fuzzing method that takes a valid sequence of communication messages and systematically alters it to generate a fuzzing input. They argued that effectiveness of such fuzzers are limited by the quality and diversity of the recorded seed message sequence, and simple mutations do not help in a way of increasing the coverage.

To break through this issue, the authors introduce LLM-guided fuzzing method, which combines the existing mutation-based approach and large language model (LLM).

Three components compose this method:

1. The fuzzer uses LLM to extract a machine-readable grammar that will be used for structure-aware mutation. In other words, the fuzzer will use the protocol specification to guide its way while mutating.
2. LLM will be used to diversify the recorded message sequences which will be used as initial seeds.
3. The fuzzer will utilize LLM to break out of a coverage plateau, where the LLM is prompted to generate messages to reach new states.

Compared to other fuzzers in ProFuzzBench’s protocol fuzzer benchmark, their work covers almost 50% more state transitions, 30% more states, and 6% more codes. Also, enabling grammar extraction, the seed enrichment, and the saturation handler each enabled their fuzzer, ChatAFL, to reach the same code coverage in 2.0, 4.6, and 6.1 times faster, respectively.

---

Background and Motivation#

A protocol is defined as the general structure and order of the messages to be exchanged. For instance, in TCP, to initiate a connection, two parties must exchange SYN, SYN + ACK, and ACK, in this order.

A protocol fuzzer generates message sequences that follows the required structure and order of a given protocol. A generator-based fuzzer tries to generate random message sequences from sratch. However, this kind of fuzzer usually covers only small portion of the protocol specification, and its implementation is tedious and error-prone.

A mutation-based fuzzer uses a set of pre-recorded message sequences as seed inputs for mutation. For instance, a pre-recorded message sequence A-B-C-D-E may be mutated to A-B'-C-D'-E.

According to the authors, the state-of-the-art approach on mutation-based protocol fuzzing still faces several challenges:

1. (C1) The effectiveness of mutation-based protocol fuzzers is severely dependent on the initial seed inputs.
2. (C2) Without machine-readable information about the message structure of a protocol, the fuzzer cannot generate structurally interesting changes to the seed.
3. (C3) Without machine-readable information regarding the state space, the fuzzer cannot identify the current state or be directed to explore previous unseen states.

---

My thoughts#

After reading this paper, I’ve learned that if I were to propose a new system, I have to break the system down into around three main parts. Those parts can be enabled and disabled to show the effectiveness of each component as the authors mentioned in the Introduction.

Also, Background and Motivation part explains main concepts of this paper, and implies some major challenges that the current approach faces.