CovFuzz: Multi-Component Fuzzer Architecture

• CovFuzz architecture is a coverage-guided fuzzer that integrates modular components to maximize code coverage across distributed network protocols.
• It combines greybox techniques with protocol-aware mutation strategies to systematically explore stateful interactions in 4G/5G systems.
• The system employs energy-based scoring and multi-component coverage aggregation to prioritize test cases and efficiently detect crashes.

CovFuzz is a class of coverage-guided fuzzers designed to efficiently uncover vulnerabilities in complex, multi-component network protocol implementations, with a particular focus on 4G and 5G systems. CovFuzz architectures seek to maximize code coverage across distributed protocol stacks by coupling dynamic feedback from instrumented targets with probabilistic or reward-driven test case generation. The architecture synthesizes advances in greybox and multi-component coverage collection, energy-based scheduling, and protocol-aware mutation to enable systematic exploration of network protocol states, both in open-source and commercial environments (Wang et al., 25 Feb 2026, Siroš et al., 2024).

1. Architectural Foundations

CovFuzz architectures, as exemplified by MulCovFuzz and CovFUZZ, extend the classical greybox fuzzing pipeline to distributed, multi-layered, and multi-component network systems. The principal elements are:

• Input Corpus Manager: Maintains a prioritized queue of seed inputs—binary blobs or protocol messages—with per-item metadata such as previous coverage, energy score, and execution count.
• Instrumentation Module: Incorporates static, source-level edge-hit instrumentation into each protocol stack component using afl-clang-fast (LLVM), producing distinct shared-memory coverage bitmaps per network function (NF).
• Coverage Monitor: Aggregates hit data across stack components through a two-tier subprocess: local real-time monitoring and a Multi-Component Coverage Collection Module (MCCM) for distributed NFs.
• Scoring & Scheduler: Computes test case energy scores $S(t)$ by combining coverage and efficiency rewards, then uses these scores to prioritize and schedule mutational fuzzing.
• Test Case Generator: Applies AFL-style low-level mutations and protocol-aware transformations to seeds, producing new candidate messages for execution.
• Executor & Crash Analyzer: Injects fuzzed protocol traffic into the target system, monitors for coverage and crash events, and symbolicates failures for triage and deduplication.

This modular architecture is designed to accommodate multi-container or physical deployments found in 4G/5G core networks, achieving both high-throughput coverage and systematic crash discovery (Wang et al., 25 Feb 2026).

2. Multi-Component Coverage Data Flow

CovFuzz's multi-component coverage mechanism is essential for distributed protocol stacks. Each NF (e.g., AMF, SMF, NRF, UPF) is instrumented at compile time to maintain a local edge-hit bitmap in POSIX shared memory using shm_open + mmap. The bucketed bitmaps (binned hit counts) enable efficient, low-overhead export of coverage state.

The coverage data flow proceeds as follows:

1. Packet Execution: A fuzzed input is dispatched to the primary NF (e.g., AMF), whose coverage bitmap is immediately read by the fuzzer.
2. Multi-NF Trigger: On detection of new local coverage, the MCCM Controller asynchronously invokes Collectors in each remote NF process/container to retrieve their bitmaps.
3. Aggregation: Bitmaps from all containers are merged into a global coverage vector $C(t)$ for each test case.
4. Feedback: This aggregated coverage directly informs subsequent scheduling, mutation, and prioritization steps (Wang et al., 25 Feb 2026).

This explicit multi-component aggregation distinguishes CovFuzz from classical single-binary fuzzers, enabling coverage tracking and vulnerability discovery that spans the stateful interactions between distributed NFs.

3. Coverage-Guided Scoring and Scheduling

CovFuzz fuzzers assign an energy score to each input $t$ according to:

$S(t) = w_1 \cdot R_c(t) + w_2 \cdot R_e(t)$

Where:

• $R_c(t) = \sum_{i=1}^n \alpha_i \cdot C_i(t)$ is the weighted sum of new coverage units per component $i$ (with weights $\alpha_i$ set by criticality or past path discovery).
• $$R_e(t) = \beta \cdot \frac{1}{T(t)} \cdot \sum_{i=1}^n C_i(t)$$ rewards inputs that uncover coverage rapidly.
• $w_1, w_2$ balance raw coverage vs. time efficiency.
• $\beta$ normalizes efficiency to coverage's order of magnitude.
• $C(t)$0 is empirical runtime.

Typical starting values are $C(t)$1, $C(t)$2, with dynamic adjustment possible to suppress slow-executing seeds. Seeds are selected for further mutation with probability proportional to $C(t)$3 and allocated $C(t)$4 mutational attempts per turn (Wang et al., 25 Feb 2026).

A key property of this reward-centric scheduling is preference for seeds that unlock rare paths in critical components, penalize slow or redundant seeds, and permit dynamic corpus reprioritization.

4. Mutation Strategies and Protocol Integration

CovFuzz architectures leverage both generic and protocol-aware mutation operators:

• Low-Level Mutations: Bit flips, arithmetic operations (+/− on word-aligned fields), insertions/deletions, and block splicing are inherited from AFL/AFLNet.
• Protocol-Aware Mutations: Field reordering (e.g., TLVs), dictionary-driven value substitution, and message sequence splicing support stateful 5G/4G interactions.
• Probabilistic Field Mutation (CovFUZZ): For per-packet field fuzzing, mutation probabilities $C(t)$5 per field $C(t)$6 are updated using:

$C(t)$7

where

$C(t)$8

with $C(t)$9 a function that increases or decreases $t$0 depending on new coverage $t$1 and the iteration number. All updates are bounded by $t$2 to enforce stability (Siroš et al., 2024).

These mutation regimes support both black-box and greybox protocol fuzzing, driving test generation efficiently towards unexercised or security-critical execution paths in the protocol stack.

5. Execution Loop and Workflow

The main fuzzing loop of CovFuzz follows a coverage-feedback-driven scheduling and mutation workflow, exemplified by the MulCovFuzz design:

$t$3

Key optimizations include:

• Batching mutational attempts per high-priority seed.
• Asynchronous collection of multi-component coverage to amortize inter-container communication latency.
• Real-time corpus re-scoring to accelerate coverage-driven exploration.

6. Implementation Considerations and Optimizations

CovFuzz features several architectural optimizations:

• Static Instrumentation: Leverages AFL / LLVM-based instrumentation for minimal runtime performance penalty, avoiding QEMU or binary patching (Wang et al., 25 Feb 2026).
• Shared Memory & IPC: Employs POSIX shared memory for coverage bitmap exchange, and lightweight UNIX sockets for inter-container communication, with bitmap diff serialization to reduce IPC volume.
• Parallelization: Supports parallel fuzzing workers sharing a common coverage controller, increasing system utilization.
• Crash Deduplication: Utilizes AddressSanitizer crash fingerprints to suppress redundant bug reports.
• Containerization: Deploys each NF in an isolated Docker environment, maintaining modularity and reducing environmental nondeterminism.

This suggests that CovFuzz architectures are compatible with both open-source stacks (e.g., OpenAirInterface, srsRAN, Open5Gs) and commercial COTS devices where code instrumentation is impractical. For black-box scenarios, CovFuzz exploits correlation between coverage on generator endpoints and DUTs, guiding testing via a coverage estimation methodology (Siroš et al., 2024).

7. Supported Protocol Layers and Deployment Scenarios

CovFuzz applies its principles across multiple protocol stack layers and diverse deployment contexts:

• Supported Layers: Medium Access Control (MAC), Radio Link Control (RLC), Packet Data Convergence Protocol (PDCP), Radio Resource Control (RRC), and Non-Access Stratum (NAS) in both 4G and 5G stacks.
• Channel Coverage: Intercepts both Common Control Channel (CCCH) and Dedicated Control Channel (DCCH) traffic for fuzzing (Siroš et al., 2024).
• Stack Integration: Hooks are inserted at RRC and MAC layers in stacks such as srsRAN and srsGNB/Open5Gs for targeted fuzzing campaigns.
• Device Types: Supports fuzzing on open-source protocol stacks as well as commercial off-the-shelf devices, leveraging both greybox and black-box strategies.

This multi-layer, multi-component approach enhances vulnerability discovery rates and strengthens code path exploration in real-world telecom environments.

---

For further details and empirical evaluations demonstrating the superiority of coverage-guided, multi-component fuzzing over black-box approaches—including statistical improvements in branch/line coverage and crash discovery—see "MulCovFuzz: A Multi-Component Coverage-Guided Greybox Fuzzer for 5G Protocol Testing" (Wang et al., 25 Feb 2026) and "CovFUZZ: Coverage-based fuzzer for 4G&5G protocols" (Siroš et al., 2024).