UFG-AFLNET: A Greybox Fuzzing Framework With Fine-Grained State Modeling and Gradient-Guided Mutation for Network Protocols

Greybox fuzzing has become an effective technique for uncovering vulnerabilities in network protocol implementations. However, existing approaches still face several significant challenges: (1) state modeling is overly coarse-grained, failing to accurately capture subtle state transitions during protocol execution, (2) focusing solely on the first mutation point that reaches the target state, overlooking other regions that may equally impact the target state, (3) neglecting the non-uniform contribution of different message regions to path coverage. To address these issues, we propose UFG-AFLNET, a unified greybox fuzzing framework. UFG-AFLNET significantly enhances fuzzing efficiency and vulnerability discovery through fine-grained state machine modeling, gradient-guided sequence selection, and lightweight dynamic taint inference. Specifically, UFG-AFLNET introduces a state clustering learner that uses the Single-Pass clustering algorithm to extend response state machines into fine-grained path state machines, thereby enabling more precise state differentiation. Additionally, to select the most critical mutation points, we employ a recurrent neural network to compute the sensitivity gradients between target path states and message regions. Finally, we use a message sequence mutator supported by dynamic taint inference to assign weights to each byte and prioritize mutations on those most likely to expose new execution paths. Experiments on five widely used protocol implementations show that UFG-AFLNET significantly outperforms baseline fuzzers in path coverage, the number of vulnerabilities discovered and so on. These results demonstrate the potential of UFG-AFLNET in advancing the field of network protocol security testing.