Fuzzing is a fundamental technique for detecting vulnerabilities in network protocols. However, existing approaches suffer from low fuzzing throughput caused by the overhead associated with server under test (SUT) restarts and connection setup. In this article, we present HSPFuzzer, a High-Speed Protocol Fuzzer that leverages connection reuse to reduce SUT restarts and connection re-establishments. To enable efficient connection reuse, it incorporates a prefix message identification algorithm to determine the essential packets required within a connection and a coverage monitoring mechanism to detect abnormal execution states. Additionally, HSPFuzzer employs an innovative message provision method that ensures input messages are delivered to the SUT with minimal delay within the same connection. HSPFuzzer also eliminates the need for manually implementing message-splitting logic by connection reuse. We evaluate HSPFuzzer on 12 widely used servers and experimental results show that HSPFuzzer achieves fuzzing throughput$1062{\times }$faster than AFLNet, whereas other state-of-the-art fuzzers, including AFLNet, SnapFuzz, HNPFuzzer, and AFL++, achieve, at most, a$12{\times }$speedup over AFLNet. Furthermore, HSPFuzzer attains an average code coverage increase of 25.1% compared to AFLNet, while competing fuzzers achieve, at most, 2.13% more coverage. Notably, HSPFuzzer also discovers more vulnerabilities, which further proves its effectiveness.

Logic vulnerabilities associated with TLS protocol implementations often do not exhibit explicit erroneous behaviors, making them difficult to detect by testers. However, these vulnerabilities can pose serious security threats. While testing for TLS protocols lacks uniform test oracles, differential fuzzing effectively addresses this issue. Unfortunately, most of these vulnerabilities are triggered in deep protocol states, and no existing work on differential fuzzing targeting these states exists. In this paper, we propose a deep differential fuzzing framework that focuses on detecting logic issues in deep TLS protocol states. Our approach is based on the message tuples we proposed, which are semi-automatically extracted from RFCs using NLP techniques. We address the problem of test interruptions during early handshakes caused by original data inconsistencies by redefining the consistency determination to achieve deep differential fuzzing. In addition, we use encoding classification statistics to achieve quick and efficient analysis of the massive test results. Based on our approach, we implemented TLS-DeepDiffer and used it to test nine kinds of popular TLS libraries. We found four historical CVEs, one newly discovered high-risk vulnerability, and 24 security or implementation issues, demonstrating the usefulness of our approach.

Recently, Deep learning (DL) compilers have been widely developed to optimize the deployment of DL models. These DL compilers transform DL models into high-level intermediate representation (IR) and then into low-level IR, ultimately generating optimized codes for different hardware targets. However, DL compilers are not immune to generating incorrect code, leading to potentially severe consequences. Testing techniques for low-level IR are limited, and efficient approaches for detecting some categories of non-crashing bugs are lacking. In this paper, we address the limitations of existing low-level IR DL compiler testing techniques and introduce DeepDiffer, a priority-guided differential testing framework designed to detect bugs resulting from low-level optimizations in the DL compiler, specifically TVM. We propose a novel DL compiler coverage metric and establish an optimization goal to maximize the detection of valuable differences between DL compilers. Our experiments demonstrate that DeepDiffer outperforms existing low-level IR fuzzers, detecting a wider range of bug types. In fact, DeepDiffer has successfully identified 13 bugs in TVM, which can be categorized into 9 distinct root causes, and 9 bugs are first found. We have submitted these bugs to the TVM community, where they have been confirmed.