Model-Based Grey-Box Fuzzing of Network Protocols

<div>The hierarchical scheduling strategy. The dotted box represents a seed pool determined by the path, such as <span class="nowrap"><svg height="11.927pt" id="M71" style="vertical-align:-3.291101pt" version="1.1" viewbox="-0.0498162 -8.6359 43.0023 11.927" width="43.0023pt" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink"><g transform="matrix(.013,0,0,-0.013,0,0)"><path d="M244 607C244 633 228 655 200 655C166 655 146 618 146 594C146 564 166 546 191 546C221 546 244 574 244 607ZM222 91L209 114C184 94 148 66 133 66C127 66 124 73 130 96L201 370C213 416 211 448 191 448C162 448 88 407 29 352L42 328C73 354 104 371 114 371C120 371 119 365 115 345L53 92C32 5 45 -12 68 -12C103 -12 186 50 222 91Z"></path></g><g transform="matrix(.0091,0,0,-0.0091,3.484,3.132)"><path d="M389 0V32C297 38 291 46 291 118V635C234 613 175 595 109 583V556L161 554C203 552 207 547 207 497V118C207 46 201 38 110 32V0H389Z"></path></g><g transform="matrix(.013,0,0,-0.013,11.336,0)"><path d="M170 255C170 288 146 313 114 313S58 288 58 255C58 221 82 198 114 198S170 221 170 255Z"></path></g><g transform="matrix(.013,0,0,-0.013,17.205,0)"><path d="M244 607C244 633 228 655 200 655C166 655 146 618 146 594C146 564 166 546 191 546C221 546 244 574 244 607ZM222 91L209 114C184 94 148 66 133 66C127 66 124 73 130 96L201 370C213 416 211 448 191 448C162 448 88 407 29 352L42 328C73 354 104 371 114 371C120 371 119 365 115 345L53 92C32 5 45 -12 68 -12C103 -12 186 50 222 91Z"></path></g><g transform="matrix(.0091,0,0,-0.0091,20.689,3.132)"><path d="M414 144C384 79 371 75 317 75H135L276 221C367 316 408 376 408 465C408 570 327 635 237 635C179 635 131 609 100 575L42 494L67 471C94 510 138 565 205 565C277 565 321 517 321 435C321 348 258 270 195 195C146 137 88 81 33 26V0H411C423 44 433 88 446 135L414 144Z"></path></g><g transform="matrix(.013,0,0,-0.013,28.541,0)"><path d="M170 255C170 288 146 313 114 313S58 288 58 255C58 221 82 198 114 198S170 221 170 255Z"></path></g><g transform="matrix(.013,0,0,-0.013,34.411,0)"><path d="M244 607C244 633 228 655 200 655C166 655 146 618 146 594C146 564 166 546 191 546C221 546 244 574 244 607ZM222 91L209 114C184 94 148 66 133 66C127 66 124 73 130 96L201 370C213 416 211 448 191 448C162 448 88 407 29 352L42 328C73 354 104 371 114 371C120 371 119 365 115 345L53 92C32 5 45 -12 68 -12C103 -12 186 50 222 91Z"></path></g><g transform="matrix(.0091,0,0,-0.0091,37.895,3.132)"><path d="M290 377C321 398 342 415 358 430C378 450 389 473 389 502C389 578 329 635 238 635H237C184 635 137 610 109 578L64 515L88 493C112 529 154 573 208 573S303 542 303 482C303 409 233 370 141 341L149 308C165 313 190 319 215 319C272 319 341 283 341 193C342 98 292 43 222 43C163 43 122 72 96 94C88 101 79 100 70 94C61 87 47 73 46 60C44 47 48 37 62 23C76 10 118 -12 165 -12C238 -12 430 62 430 223C430 297 379 359 290 375V377Z"></path></g></svg>.</span> The seed pool consists of interesting messages that are assigned weights based on the code coverage.</div>

Security and Communication Networks

Model-Based Grey-Box Fuzzing of Network Protocols

Figure 3