# Leveraging Textual Specifications for Grammar-based Fuzzing of Network Protocols

arXiv: https://arxiv.org/abs/1810.04755 · HTML: https://mlsanity.com/paper/1810.04755/

## Key facts

- Cited by 3 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 10 Oct 2018.

## Built on by (most cited first, 3 of 3)

- [Automated Attack Synthesis by Extracting Finite State Machines from Protocol Specification Documents](https://mlsanity.com/paper/2202.09470/) (2022)
- [Hermes: Unlocking Security Analysis of Cellular Network Protocols by Synthesizing Finite State Machines from Natural Language Specifications](https://mlsanity.com/paper/2310.04381/) (2023)
- [RFSeek and Ye Shall Find](https://mlsanity.com/paper/2509.10216/) (2025)

## Abstract (arXiv)

Grammar-based fuzzing is a technique used to find software vulnerabilities by injecting well-formed inputs generated following rules that encode application semantics. Most grammar-based fuzzers for network protocols rely on human experts to manually specify these rules. In this work we study automated learning of protocol rules from textual specifications (i.e. RFCs). We evaluate the automatically extracted protocol rules by applying them to a state-of-the-art fuzzer for transport protocols and show that it leads to a smaller number of test cases while finding the same attacks as the system that uses manually specified rules.