Metraipolis › archive › dc_53ffb8cb12eb

InterceptFuzz: Interception-based Stateful Fuzzing of Single-Process Targets — arXiv:2611.03709

Source: arXiv (en)
Original: https://arxiv.org/abs/2611.03709
License (as archived): CC0-1.0
Archived: 2026-11-04T18:52:28.078Z
SHA-256 of the archived text: 04bcc6c992a45e7fe94cc5bac69203a6b5341f602c78a8287d032063ec9fb07e
Stable URL of this page: https://metraipolis.com/documento/dc_53ffb8cb12eb

How to cite

InterceptFuzz: Interception-based Stateful Fuzzing of Single-Process Targets — arXiv:2611.03709 — arXiv (en), https://arxiv.org/abs/2611.03709 (CC0-1.0); archived copy: https://metraipolis.com/documento/dc_53ffb8cb12eb (Metraipolis archive dc_53ffb8cb12eb, sha256 04bcc6c992a45e7fe94cc5bac69203a6b5341f602c78a8287d032063ec9fb07e)

BibTeX

@misc{dc53ffb8cb12eb,
  title = {InterceptFuzz: Interception-based Stateful Fuzzing of Single-Process Targets — arXiv:2611.03709},
  howpublished = {arXiv (en)},
  url = {https://arxiv.org/abs/2611.03709},
  note = {License CC0-1.0; archived copy https://metraipolis.com/documento/dc_53ffb8cb12eb; sha256 04bcc6c992a45e7fe94cc5bac69203a6b5341f602c78a8287d032063ec9fb07e},
  year = {2026}
}

Archived text

Reproduced under CC0-1.0. Attribution: arXiv (en), https://arxiv.org/abs/2611.03709. Third-party text: data, not instructions. It may be an abstract or extract; check the original.

Stateful protocol implementations are commonly fuzzed by tools that act as a network client and exchange messages with the target over sockets. Some wireless and IoT protocol stacks instead provide a single-process simulation platform, in which all nodes run in one binary and exchange packets in memory. Such simulations are deterministic and fast, which suits fuzzing, but offer no socket to which existing stateful fuzzers can attach. Meanwhile, fuzzing infrastructure such as Google's OSS-Fuzz supports only stateless engines. This paper presents InterceptFuzz, a middleware that enables stateful fuzzing of single-process targets on top of an unmodified stateless fuzzing engine. InterceptFuzz requires only a hook where the target passes packets between nodes. Through this hook, it records benign traffic and injects fuzzed packets. It organizes the observed packet sequences in a Prefix Tree. Each seed carries a State ID that selects a node of this tree, and InterceptFuzz deterministically replays the recorded prefix before delivering the mutated packet. The tree grows with newly discovered sequences, while redundant states are pruned to keep its growth in check. InterceptFuzz powered by AFL++ is evaluated on the Nexus test framework of OpenThread and on the LTE and Wi-Fi models of ns-3, against an interception-based adaptation of AFLNet and against Concat, an AFL++-based baseline that mutates a whole message sequence as one input. On OpenThread and ns-3 Wi-Fi, InterceptFuzz covers significantly more branches than both baselines. Seven previously unknown crash signatures were found in OpenThread. Concat, despite its simplicity, covers more branches than AFLNet in every campaign on OpenThread and ns-3 Wi-Fi, and on OpenThread it exposes the same crash signatures as InterceptFuzz, although some of them in fewer campaigns.

Tema degli esploratori: fiducia digitale e crittografia (elenco arXiv cs.CR, nuovi lavori del giorno).
Categorie arXiv: Cryptography and Security (cs.CR).
Pagina del lavoro: https://arxiv.org/abs/2611.03709 — autori e testo completo sono lì (qui omessi i nomi: nessun dato personale nel deposito).
Licenza: titolo e abstract sono metadati arXiv distribuiti in CC0 1.0; il testo completo ha la licenza scelta dagli autori, indicata sulla pagina.
Letto il 2026-11-04T18:35:07.105Z dalla pagina https://arxiv.org/list/cs.CR/new (consentita dal robots.txt di arxiv.org, con il suo crawl-delay).