Greybox fuzzing has become an effective technique for uncovering vulnerabilities in network protocol implementations. However, existing approaches still face several significant challenges: (1) state modeling is overly coarse-grained, failing to accurately capture subtle state transitions during protocol execution, (2) focusing solely on the first mutation point that reaches the target state, overlooking other regions that may equally impact the target state, (3) neglecting the non-uniform contribution of different message regions to path coverage. To address these issues, we propose UFG-AFLNET, a unified greybox fuzzing framework. UFG-AFLNET significantly enhances fuzzing efficiency and vulnerability discovery through fine-grained state machine modeling, gradient-guided sequence selection, and lightweight dynamic taint inference. Specifically, UFG-AFLNET introduces a state clustering learner that uses the Single-Pass clustering algorithm to extend response state machines into fine-grained path state machines, thereby enabling more precise state differentiation. Additionally, to select the most critical mutation points, we employ a recurrent neural network to compute the sensitivity gradients between target path states and message regions. Finally, we use a message sequence mutator supported by dynamic taint inference to assign weights to each byte and prioritize mutations on those most likely to expose new execution paths. Experiments on five widely used protocol implementations show that UFG-AFLNET significantly outperforms baseline fuzzers in path coverage, the number of vulnerabilities discovered and so on. These results demonstrate the potential of UFG-AFLNET in advancing the field of network protocol security testing.

Instruction reordering is an essential optimization technique used in both compilers and multi-core processors to enhance parallelism and resource utilization. Although the original intent of this technique is to benefit the program, some improper reordering can significantly impact the program correctness, which we call instruction reordering vulnerability (IRV). However, existing methods detect IRV by defining CPU instruction reordering rules to schedule execution paths while neglecting compiler reordering, and thus generate false positives that require manual filtering and resulting in inefficiency. To bridge this gap, in this paper, we propose the IRV detection method, , which analyzes IRV characteristics and extracts vulnerability patterns, integrating program dependency analysis for compiler reordering and memory model constraints for CPU reordering. Specifically, we use static analysis based on specific patterns to narrow the analysis scope, and adopt log-based dynamic analysis to confirm vulnerability by checking the log constraints. We built the IRV benchmark to compare IRHunter with five state-of-the-art tools (i.e., GENMC, Nidhugg, CBMC, SHB, BiRD). IRHunter detected all 19 errors, doubling the best model checking tools' performance, with half the false positive rate of leading data race detectors. It was 10× faster on small programs and outperformed data race detectors on large programs.

With the growing popularity of Android devices, Android malware is seriously threatening the safety of users. Although such threats can be detected by deep learning as a service (DLaaS), deep neural networks as the weakest part of DLaaS are often deceived by the adversarial samples elaborated by attackers. In this paper, we propose a new semi-black-box attack framework called one-feature-each-iteration (OFEI) to craft Android adversarial samples. This framework modifies as few features as possible and requires less classifier information to fool the classifier. We conduct a controlled experiment to evaluate our OFEI framework by comparing it with the benchmark methods JSMF, GenAttack and pointwise attack. The experimental results show that our OFEI has a higher misclassification rate of 98.25%. Furthermore, OFEI can extend the traditional white-box attack methods in the image field, such as fast gradient sign method (FGSM) and DeepFool, to craft adversarial samples for Android. Finally, to enhance the security of DLaaS, we use two uncertainties of the Bayesian neural network to construct the combined uncertainty, which is used to detect adversarial samples and achieves a high detection rate of 99.28%.