摘要
Addressing the issues of high redundancy,poor targeting,and low efficiency in the fuzzy testing process of application-layer network protocols,NetFuzz,a novel multi-objective fuzzy testing tool based on a classification tree was introduced in this paper. NetFuzz utilizes a four-tiered classification tree protocol description method for application-layer network protocols,encompassing the protocol under test,its functions,specific commands,parameters,and variant markers. A multi-objective optimization model is designed to enhance the coverage,validity,and diversity of test cases,with a genetic algorithm employed to generate these cases. The tool is evaluated by testing file transfer protocol( FTP) and hypertext transfer protocol( HTTP) servers with known vulnerabilities,comparing its performance against the Peach fuzzing tool. NetFuzz can effectively detect security vulnerabilities that Peach Fuzzer tool failed to identify. While ensuring the detection of vulnerabilities,the testing time is reduced by approximately 58%,and the number of valid test cases increases by 47. 67%.
