# State Selection Algorithms and Their Impact on The Performance of Stateful Network Protocol Fuzzing

arXiv: https://arxiv.org/abs/2112.15498 · HTML: https://mlsanity.com/paper/2112.15498/

## Key facts

- Cited by 3 papers in the map (data through 14 Oct 2026).
- Builds on 8 of its 38 references that are in the map.
- First posted on arXiv 24 Dec 2021.

## Builds on (most cited first, 8 of 8)

- [The Art, Science, and Engineering of Fuzzing: A Survey](https://mlsanity.com/paper/1812.00140/) (2018)
- [Evaluating Fuzz Testing](https://mlsanity.com/paper/1808.09700/) (2018)
- [Magma: A Ground-Truth Fuzzing Benchmark](https://mlsanity.com/paper/2009.01120/) (2020)
- [Smart Greybox Fuzzing](https://mlsanity.com/paper/1811.09447/) (2018)
- [StateAFL: Greybox Fuzzing for Stateful Network Servers](https://mlsanity.com/paper/2110.06253/) (2021)
- [ProFuzzBench: A Benchmark for Stateful Protocol Fuzzing](https://mlsanity.com/paper/2101.05102/) (2021)
- [Legion: Best-First Concolic Testing](https://mlsanity.com/paper/2002.06311/) (2020)
- [Guidelines on Minimum Standards for Developer Verification of Software](https://mlsanity.com/paper/2107.12850/) (2021)

## Built on by (most cited first, 3 of 3)

- [Attention Distance: A Novel Metric for Directed Fuzzing with Large Language Models](https://mlsanity.com/paper/2512.19758/) (2025)
- [An Agentic Flow for Finite State Machine Extraction using Prompt Chaining](https://mlsanity.com/paper/2507.11222/) (2025)
- [MultiFuzz: A Dense Retrieval-based Multi-Agent System for Network Protocol Fuzzing](https://mlsanity.com/paper/2508.14300/) (2025)

## Abstract (arXiv)

The statefulness property of network protocol implementations poses a unique challenge for testing and verification techniques, including Fuzzing. Stateful fuzzers tackle this challenge by leveraging state models to partition the state space and assist the test generation process. Since not all states are equally important and fuzzing campaigns have time limits, fuzzers need effective state selection algorithms to prioritize progressive states over others. Several state selection algorithms have been proposed but they were implemented and evaluated separately on different platforms, making it hard to achieve conclusive findings. In this work, we evaluate an extensive set of state selection algorithms on the same fuzzing platform that is AFLNet, a state-of-the-art fuzzer for network servers. The algorithm set includes existing ones supported by AFLNet and our novel and principled algorithm called AFLNetLegion. The experimental results on the ProFuzzBench benchmark show that (i) the existing state selection algorithms of AFLNet achieve very similar code coverage, (ii) AFLNetLegion clearly outperforms these algorithms in selected case studies, but (iii) the overall improvement appears insignificant. These are unexpected yet interesting findings. We identify problems and share insights that could open opportunities for future research on this topic.