State Selection Algorithms and Their Impact on The Performance of
  Stateful Network Protocol Fuzzing
  The statefulness property of network protocol implementations poses a unique
challenge for testing and verification techniques, including Fuzzing. Stateful
fuzzers tackle this challenge by leveraging state models to partition the state
space and assist the test generation process. Since not all states are equally
important and fuzzing campaigns have time limits, fuzzers need effective state
selection algorithms to prioritize progressive states over others. Several
state selection algorithms have been proposed but they were implemented and
evaluated separately on different platforms, making it hard to achieve
conclusive findings. In this work, we evaluate an extensive set of state
selection algorithms on the same fuzzing platform that is AFLNet, a
state-of-the-art fuzzer for network servers. The algorithm set includes
existing ones supported by AFLNet and our novel and principled algorithm called
AFLNetLegion. The experimental results on the ProFuzzBench benchmark show that
(i) the existing state selection algorithms of AFLNet achieve very similar code
coverage, (ii) AFLNetLegion clearly outperforms these algorithms in selected
case studies, but (iii) the overall improvement appears insignificant. These
are unexpected yet interesting findings. We identify problems and share
insights that could open opportunities for future research on this topic.
