{"id":"https://openalex.org/W7162082767","doi":"https://doi.org/10.1109/tnsm.2026.3695923","title":"UFG-AFLNET: A Greybox Fuzzing Framework With Fine-Grained State Modeling and Gradient-Guided Mutation for Network Protocols","display_name":"UFG-AFLNET: A Greybox Fuzzing Framework With Fine-Grained State Modeling and Gradient-Guided Mutation for Network Protocols","publication_year":2026,"publication_date":"2026-01-01","ids":{"openalex":"https://openalex.org/W7162082767","doi":"https://doi.org/10.1109/tnsm.2026.3695923"},"language":null,"primary_location":{"id":"doi:10.1109/tnsm.2026.3695923","is_oa":false,"landing_page_url":"https://doi.org/10.1109/tnsm.2026.3695923","pdf_url":null,"source":{"id":"https://openalex.org/S173527311","display_name":"IEEE Transactions on Network and Service Management","issn_l":"1932-4537","issn":["1932-4537","2373-7379"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Transactions on Network and Service Management","raw_type":"journal-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5136772004","display_name":"Guangquan Xu","orcid":"https://orcid.org/0000-0001-8701-3944"},"institutions":[{"id":"https://openalex.org/I162868743","display_name":"Tianjin University","ror":"https://ror.org/012tb2g32","country_code":"CN","type":"education","lineage":["https://openalex.org/I162868743"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Guangquan Xu","raw_affiliation_strings":["School of Cyber Security, Tianjin University, Tianjin, China"],"raw_orcid":"https://orcid.org/0000-0001-8701-3944","affiliations":[{"raw_affiliation_string":"School of Cyber Security, Tianjin University, Tianjin, China","institution_ids":["https://openalex.org/I162868743"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5136748073","display_name":"Tuoyu Chen","orcid":"https://orcid.org/0009-0003-8808-5693"},"institutions":[{"id":"https://openalex.org/I162868743","display_name":"Tianjin University","ror":"https://ror.org/012tb2g32","country_code":"CN","type":"education","lineage":["https://openalex.org/I162868743"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Tuoyu Chen","raw_affiliation_strings":["School of Cyber Security, Tianjin University, Tianjin, China"],"raw_orcid":"https://orcid.org/0009-0003-8808-5693","affiliations":[{"raw_affiliation_string":"School of Cyber Security, Tianjin University, Tianjin, China","institution_ids":["https://openalex.org/I162868743"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5047646343","display_name":"Guohua Xin","orcid":"https://orcid.org/0000-0002-9525-0728"},"institutions":[{"id":"https://openalex.org/I162868743","display_name":"Tianjin University","ror":"https://ror.org/012tb2g32","country_code":"CN","type":"education","lineage":["https://openalex.org/I162868743"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Guohua Xin","raw_affiliation_strings":["School of Cyber Security, Tianjin University, Tianjin, China"],"raw_orcid":"https://orcid.org/0000-0002-9525-0728","affiliations":[{"raw_affiliation_string":"School of Cyber Security, Tianjin University, Tianjin, China","institution_ids":["https://openalex.org/I162868743"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5136779487","display_name":"Wei Yu","orcid":"https://orcid.org/0000-0003-3459-3695"},"institutions":[{"id":"https://openalex.org/I162868743","display_name":"Tianjin University","ror":"https://ror.org/012tb2g32","country_code":"CN","type":"education","lineage":["https://openalex.org/I162868743"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Wei Yu","raw_affiliation_strings":["School of Cyber Security, Tianjin University, Tianjin, China"],"raw_orcid":"https://orcid.org/0000-0003-3459-3695","affiliations":[{"raw_affiliation_string":"School of Cyber Security, Tianjin University, Tianjin, China","institution_ids":["https://openalex.org/I162868743"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5136759914","display_name":"Hongpeng Bai","orcid":"https://orcid.org/0000-0002-6298-3327"},"institutions":[{"id":"https://openalex.org/I162868743","display_name":"Tianjin University","ror":"https://ror.org/012tb2g32","country_code":"CN","type":"education","lineage":["https://openalex.org/I162868743"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Hongpeng Bai","raw_affiliation_strings":["School of Cyber Security, Tianjin University, Tianjin, China"],"raw_orcid":"https://orcid.org/0000-0002-6298-3327","affiliations":[{"raw_affiliation_string":"School of Cyber Security, Tianjin University, Tianjin, China","institution_ids":["https://openalex.org/I162868743"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5004904800","display_name":"Z Li","orcid":null},"institutions":[{"id":"https://openalex.org/I102208913","display_name":"Shihezi University","ror":"https://ror.org/04x0kvm78","country_code":"CN","type":"education","lineage":["https://openalex.org/I102208913"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Zhigang Li","raw_affiliation_strings":["College of Information Science and Technology, Shihezi University, Shihezi, China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"College of Information Science and Technology, Shihezi University, Shihezi, China","institution_ids":["https://openalex.org/I102208913"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":2,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":0.0,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":{"value":0.63265473,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":null,"biblio":{"volume":"23","issue":null,"first_page":"4819","last_page":"4834"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10714","display_name":"Software-Defined Networks and 5G","score":0.5109999775886536,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10714","display_name":"Software-Defined Networks and 5G","score":0.5109999775886536,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10847","display_name":"Advanced Optical Network Technologies","score":0.16439999639987946,"subfield":{"id":"https://openalex.org/subfields/2208","display_name":"Electrical and Electronic Engineering"},"field":{"id":"https://openalex.org/fields/22","display_name":"Engineering"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10138","display_name":"Network Traffic and Congestion Control","score":0.0754999965429306,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/fuzz-testing","display_name":"Fuzz testing","score":0.6657999753952026},{"id":"https://openalex.org/keywords/state","display_name":"State (computer science)","score":0.5346999764442444},{"id":"https://openalex.org/keywords/protocol","display_name":"Protocol (science)","score":0.4375},{"id":"https://openalex.org/keywords/communications-protocol","display_name":"Communications protocol","score":0.3971000015735626},{"id":"https://openalex.org/keywords/routing-protocol","display_name":"Routing protocol","score":0.3756999969482422},{"id":"https://openalex.org/keywords/mutation","display_name":"Mutation","score":0.3305000066757202},{"id":"https://openalex.org/keywords/key","display_name":"Key (lock)","score":0.3237999975681305}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.8547999858856201},{"id":"https://openalex.org/C111065885","wikidata":"https://www.wikidata.org/wiki/Q1189053","display_name":"Fuzz testing","level":3,"score":0.6657999753952026},{"id":"https://openalex.org/C31258907","wikidata":"https://www.wikidata.org/wiki/Q1301371","display_name":"Computer network","level":1,"score":0.5845999717712402},{"id":"https://openalex.org/C48103436","wikidata":"https://www.wikidata.org/wiki/Q599031","display_name":"State (computer science)","level":2,"score":0.5346999764442444},{"id":"https://openalex.org/C2780385302","wikidata":"https://www.wikidata.org/wiki/Q367158","display_name":"Protocol (science)","level":3,"score":0.4375},{"id":"https://openalex.org/C120314980","wikidata":"https://www.wikidata.org/wiki/Q180634","display_name":"Distributed computing","level":1,"score":0.4293000102043152},{"id":"https://openalex.org/C12269588","wikidata":"https://www.wikidata.org/wiki/Q132364","display_name":"Communications protocol","level":2,"score":0.3971000015735626},{"id":"https://openalex.org/C104954878","wikidata":"https://www.wikidata.org/wiki/Q1648707","display_name":"Routing protocol","level":3,"score":0.3756999969482422},{"id":"https://openalex.org/C501734568","wikidata":"https://www.wikidata.org/wiki/Q42918","display_name":"Mutation","level":3,"score":0.3305000066757202},{"id":"https://openalex.org/C26517878","wikidata":"https://www.wikidata.org/wiki/Q228039","display_name":"Key (lock)","level":2,"score":0.3237999975681305},{"id":"https://openalex.org/C2985963534","wikidata":"https://www.wikidata.org/wiki/Q7603704","display_name":"State information","level":3,"score":0.29829999804496765},{"id":"https://openalex.org/C80444323","wikidata":"https://www.wikidata.org/wiki/Q2878974","display_name":"Theoretical computer science","level":1,"score":0.2867000102996826},{"id":"https://openalex.org/C125411270","wikidata":"https://www.wikidata.org/wiki/Q18653","display_name":"Encoding (memory)","level":2,"score":0.26809999346733093},{"id":"https://openalex.org/C51675839","wikidata":"https://www.wikidata.org/wiki/Q1665681","display_name":"Intelligent Network","level":2,"score":0.26739999651908875},{"id":"https://openalex.org/C182590292","wikidata":"https://www.wikidata.org/wiki/Q989632","display_name":"Network security","level":2,"score":0.2623000144958496},{"id":"https://openalex.org/C2780451532","wikidata":"https://www.wikidata.org/wiki/Q759676","display_name":"Task (project management)","level":2,"score":0.26109999418258667},{"id":"https://openalex.org/C113508815","wikidata":"https://www.wikidata.org/wiki/Q193446","display_name":"Packet switching","level":3,"score":0.2531999945640564},{"id":"https://openalex.org/C3020028006","wikidata":"https://www.wikidata.org/wiki/Q9158","display_name":"Electronic mail","level":2,"score":0.25130000710487366}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1109/tnsm.2026.3695923","is_oa":false,"landing_page_url":"https://doi.org/10.1109/tnsm.2026.3695923","pdf_url":null,"source":{"id":"https://openalex.org/S173527311","display_name":"IEEE Transactions on Network and Service Management","issn_l":"1932-4537","issn":["1932-4537","2373-7379"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Transactions on Network and Service Management","raw_type":"journal-article"}],"best_oa_location":null,"sustainable_development_goals":[{"display_name":"Climate action","id":"https://metadata.un.org/sdg/13","score":0.6359682083129883}],"awards":[{"id":"https://openalex.org/G1502308759","display_name":null,"funder_award_id":"U25A20424","funder_id":"https://openalex.org/F4320321001","funder_display_name":"National Natural Science Foundation of China"},{"id":"https://openalex.org/G2600797253","display_name":null,"funder_award_id":"23YDPYGX00140","funder_id":"https://openalex.org/F4320336756","funder_display_name":"Tianjin Science and Technology Program"},{"id":"https://openalex.org/G6896414497","display_name":null,"funder_award_id":"U2468204","funder_id":"https://openalex.org/F4320321001","funder_display_name":"National Natural Science Foundation of China"},{"id":"https://openalex.org/G7465859601","display_name":null,"funder_award_id":"U22B2027","funder_id":"https://openalex.org/F4320321001","funder_display_name":"National Natural Science Foundation of China"},{"id":"https://openalex.org/G7960374069","display_name":null,"funder_award_id":"2023YFB2703800","funder_id":"https://openalex.org/F4320335777","funder_display_name":"National Key Research and Development Program of China"}],"funders":[{"id":"https://openalex.org/F4320321001","display_name":"National Natural Science Foundation of China","ror":"https://ror.org/01h0zpd94"},{"id":"https://openalex.org/F4320335777","display_name":"National Key Research and Development Program of China","ror":null},{"id":"https://openalex.org/F4320336756","display_name":"Tianjin Science and Technology Program","ror":null}],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":0,"referenced_works":[],"related_works":[],"abstract_inverted_index":{"Greybox":[0],"fuzzing":[1,83,88],"has":[2],"become":[3],"an":[4],"effective":[5],"technique":[6],"for":[7],"uncovering":[8],"vulnerabilities":[9,211],"in":[10,205,223],"network":[11,148,228],"protocol":[12,36,196,229],"implementations.":[13],"However,":[14],"existing":[15],"approaches":[16],"still":[17],"face":[18],"several":[19],"significant":[20],"challenges:":[21],"(1)":[22],"state":[23,33,95,110,122,127,133],"modeling":[24],"is":[25],"overly":[26],"coarse-grained,":[27],"failing":[28],"to":[29,70,119,136,149,173,176,186],"accurately":[30],"capture":[31],"subtle":[32],"transitions":[34],"during":[35],"execution,":[37],"(2)":[38],"focusing":[39],"solely":[40],"on":[41,182,192],"the":[42,48,58,63,115,138,151,208,219,225],"first":[43],"mutation":[44,141],"point":[45],"that":[46,54,113,199],"reaches":[47],"target":[49,59,155],"state,":[50,60],"overlooking":[51],"other":[52],"regions":[53,69],"may":[55],"equally":[56],"impact":[57],"(3)":[61],"neglecting":[62],"non-uniform":[64],"contribution":[65],"of":[66,210,221,227],"different":[67],"message":[68,159,165],"path":[71,126,156,206],"coverage.":[72],"To":[73],"address":[74],"these":[75],"issues,":[76],"we":[77,143,162],"propose":[78],"UFG-AFLNET,":[79],"a":[80,109,145,164],"unified":[81],"greybox":[82],"framework.":[84],"UFG-AFLNET":[85,107,200,222],"significantly":[86,201],"enhances":[87],"efficiency":[89],"and":[90,101,158,179,213],"vulnerability":[91],"discovery":[92],"through":[93],"fine-grained":[94,125],"machine":[96],"modeling,":[97],"gradient-guided":[98],"sequence":[99,166],"selection,":[100],"lightweight":[102],"dynamic":[103,170],"taint":[104,171],"inference.":[105],"Specifically,":[106],"introduces":[108],"clustering":[111,117],"learner":[112],"uses":[114],"Single-Pass":[116],"algorithm":[118],"extend":[120],"response":[121],"machines":[123],"into":[124],"machines,":[128],"thereby":[129],"enabling":[130],"more":[131],"precise":[132],"differentiation.":[134],"Additionally,":[135],"select":[137],"most":[139,184],"critical":[140],"points,":[142],"employ":[144],"recurrent":[146],"neural":[147],"compute":[150],"sensitivity":[152],"gradients":[153],"between":[154],"states":[157],"regions.":[160],"Finally,":[161],"use":[163],"mutator":[167],"supported":[168],"by":[169],"inference":[172],"assign":[174],"weights":[175],"each":[177],"byte":[178],"prioritize":[180],"mutations":[181],"those":[183],"likely":[185],"expose":[187],"new":[188],"execution":[189],"paths.":[190],"Experiments":[191],"five":[193],"widely":[194],"used":[195],"implementations":[197],"show":[198],"outperforms":[202],"baseline":[203],"fuzzers":[204],"coverage,":[207],"number":[209],"discovered":[212],"so":[214],"on.":[215],"These":[216],"results":[217],"demonstrate":[218],"potential":[220],"advancing":[224],"field":[226],"security":[230],"testing.":[231]},"counts_by_year":[],"updated_date":"2026-05-30T06:14:24.967023","created_date":"2026-05-23T00:00:00"}