# SATFuzz: A Stateful Network Protocol Fuzzing Framework from a Novel Perspective
## 3 Architecture
### Test Case Filter  
The existing methods directly input test cases from Mutator into the protocol entity, without knowing whether the protocol entity can receive them, and most test cases are discarded due to invalidity--namely, not meeting the protocol specification or matching the \begin{table}
\begin{tabular}{c p{142.3 pt}} \hline \hline
**Elements** & **Meaning** \\ \hline \multirow{2}{*}{ProcOptim} & Main element of the test file, representing all the information needed to optimize the stateful network protocol fuzzing process \\ \hline \multirow{2}{*}{TotalStates} & Child element of ProcOptim, representing the total number of states that have been explored \\ \hline \multirow{2}{*}{StateSeqInfo} & Child element of ProcOptim, representing the information of the optimal test sequence corresponding to a certain state \\ \hline \multirow{2}{*}{StatusCode} & Child element of StateSeqInfo, representing the state identified by the status code \\ \hline \multirow{2}{*}{GuidingMesNum} & Child element of StateSeqInfo, representing the number of request messages in the pre-lead sequence \\ \hline \multirow{2}{*}{BackMesNum} & Child element of StateSeqInfo, representing the number of request messages in the post-end sequence \\ \hline \multirow{2}{*}{HiPriMesPro} & Child element of StateSeqInfo, representing the proportion of request messages that can trigger high-priority states in the post-end sequence \\ \hline \multirow{2}{*}{OptimSeqName} & Child element of StateSeqInfo, representing the name of the optimal test sequence \\ \hline \hline \end{tabular}
\end{table} 
Table 3: Basic elements of the test file. state of the protocol entity; this affects the efficiency of vulnerability discovery. Therefore, we use deep learning to filter the test cases, determine the validity of test cases before interaction, and avoid invalid interactions. A test case is similar to long time-series data, which means that the beginning data in a long sequence can affect the ending data; therefore, we mainly consider two aspects when designing the test case filter. One is how to improve the data processing capabilities of the filter; the other is how to improve its parallel computing capabilities. By comparing and analyzing common deep learning models, we finally choose a QRNN [29] to implement the test case filter. In order to eliminate the differences between different stateful network protocols, we design a general input representation method, and its algorithm is shown in Algorithm 1. We divide the old test case M in the optimal test sequence by bytes to form a byte stream vector \(X=\langle x_{1}+1,x_{2}+1,\ldots,x_{m}+1\rangle\), where \(x_{i}\) is the \(i\)-th byte in M, \(x_{i}\in\{0,1,\ldots,255\}\), and m is the total number of bytes in M.  
We also divide the new test case \(M^{\prime}\) mutated by M in the same way and form a byte stream vector \(X^{\prime}=\langle x_{1}^{\prime}+1,x_{2}^{\prime}+1,\ldots,x_{n}^{\prime}+1\rangle\), where \(x_{i}^{\prime}\) is the i-th byte in \(M^{\prime}\), \(x_{i}^{\prime}\in\{0,1,\ldots,255\}\), and n is the total number of bytes in \(M^{\prime}\). We perform tail zeroization on the byte stream vector with a smaller length (X or \(X^{\prime}\)) to make both lengths consistent and take the byte stream vector \(P=X\oplus X^{\prime}=\langle p_{1},p_{2},\ldots,p_{k}\rangle\) generated by the XOR operation between the two as the input of the QRNN, where \(p_{i}\) is the i-th byte in P, \(p_{i}\in\{0,1\}\), and k=max{m,n} is the total number of bytes in P. At the same time, 1 is used as the output value of a valid test case, and 0 is used as the output value of an invalid test case. ```
0: old test case M and new test case \(M^{\prime}\)
0: byte stream vector P
1: Extract the old test case M from the optimal test sequence and divide M by bytes to form a byte stream vector X. 2: Divide the new test case \(M^{\prime}\) mutated by M in the same way to form a byte stream vector \(X^{\prime}\).