ICST 2025
Mon 31 March - Fri 4 April 2025 Naples, Italy
Wed 2 Apr 2025 11:00 - 11:15 at Room A1 - Fuzzing and Security Chair(s): Serge Demeyer

Performance issues in software-defined network (SDN) controllers can have serious impacts on the performance and availability of networks. In this paper, we consider a special class of SDN vulnerabilities called stateful performance issues (SPIs), where a sequence of initial input messages drives the controller into a state such that its performance degrades pathologically when processing subsequent messages. Uncovering SPNs in large complex software such as the widely used ONOS SDN controller is challenging because of the large state space of input sequences and the complex software architecture of inter-dependent network services. We present SPIDER, a practical fuzzing framework for identifying SPIs in this setting. The key contribution in our work is to leverage the event-driven modular software architecture of the SDN controller to (a) separately target each network service for SPIs and (b) use static analysis to identify all services whose event handlers can affect the state of the target service directly or indirectly. SPIDER implements this novel dependency-aware modular performance fuzzing approach for 157 network services in ONOS and successfully identifies 10 new performance issues. We present an evaluation of SPIDER against prior work, a sensitivity analysis of design decisions, and case studies of two uncovered SPIs.

Wed 2 Apr

Displayed time zone: Amsterdam, Berlin, Bern, Rome, Stockholm, Vienna change

11:00 - 12:30
Fuzzing and SecurityResearch Papers / Industry / Journal-First Papers at Room A1
Chair(s): Serge Demeyer University of Antwerp and Flanders Make vzw
11:00
15m
Talk
SPIDER: Fuzzing for Stateful Performance Issues in the ONOS Software-Defined Network Controller
Research Papers
Ao Li Carnegie Mellon University, Rohan Padhye Carnegie Mellon University, Vyas Sekar Carnegie Mellon University
11:15
15m
Talk
Mutation-based Fuzzing of the Swift Compiler With Incomplete Type Information
Research Papers
Sarah Canto Hyatt University of California, Santa Barbara, Kyle Dewey California State University, Northridge
11:30
15m
Talk
Scalable SMT Sampling for Floating-point Formulas via Coverage-guided Fuzzing
Research Papers
Manuel Carrasco Imperial College London, Cristian Cadar Imperial College London, Alastair F. Donaldson Imperial College London
11:45
15m
Talk
Introducing Black-Box Fuzz Testing for REST APIs in Industry: Challenges and Solutions
Industry
Andrea Arcuri Kristiania University College and Oslo Metropolitan University, Alexander Poth Volkswagen AG, Olsi Rrjolli Volkswagen AG
12:00
15m
Talk
Compiler Fuzzing in Continuous Integration: a Case Study on Dafny
Industry
Karnbongkot Boonriong Imperial College London, Stefan Zetzsche Amazon Web Services, Alastair F. Donaldson Imperial College London
12:15
15m
Talk
Automated SC-MCC Test Case Generation using Coverage Guided Fuzzing
Journal-First Papers
Golla Monika Rani , Sangharatna Godboley National Institute of Technology Warangal
:
:
:
: