一句话：从网络流量自动生成 Peach 的 Pit 测试模板，免去人工编写，覆盖率达手工水平并发现 5 个新缺陷。
协议模糊测试的效果高度依赖测试模板的质量，即 Peach 框架使用的 Pit 文件（基于 XML，同时定义数据模型与状态模型），但手工编写这些文件耗时、易错且需要专业领域知识，阻碍了模糊测试的自动化。本文提出 Shark2Pit，一个从网络流量自动生成 Pit 文件的工具：它首先用 Tshark 解析流量、提取协议元数据并构建数据模型，随后在保持结构的前提下合成新的数据模型；状态模型由数据模型序列构建，并通过状态重组与重复进一步增强；最后将两类模型与预定义配置结合生成完整 Pit 文件。作者在 8 个开源协议上评估，生成的 Pit 文件分支覆盖率与手工文件相当甚至更高（Peach 为 99.4%–106.3%，Peach* 为 90.6%–102.3%），并借助这些模板发现 5 个此前未知的缺陷。
The effectiveness of protocol fuzzing depends on the quality of test templates, specifically the Pit file (XML-based definitions used by the Peach frameworks). These Pit files define both data models and state models. However, manually creating these Pit files is not only time-consuming and error-prone but also requires specialized domain knowledge, hindering the automation process. In this paper, we introduce Shark2Pit, an automated tool that generates Pit files from network traffic. Shark2Pit uses Tshark to parse traffic, extract protocol metadata, and construct data models. Then Shark2Pit synthesizes new data models while preserving their structure. The state model is built from data model sequences, further enhanced by state recombination and repetition. Shark2Pit combines these models with predefined configurations to generate a Pit file. We evaluated Shark2Pit on 8 open-source protocols. The branch coverage of the generated Pit files is comparable to or even higher than that of manually created Pit files (99.4%-106.3% for Peach and 90.6%-102.3% for Peach*). Furthermore, fuzzing with these Pit files revealed 5 previously unknown bugs.
@inproceedings{FuCMLCSFS26,
title = {Shark2Pit: Automated Test Template Generation for Protocol Fuzzing Based on Packet Parser},
author = {Yulai Fu and Yuanliang Chen and Fuchen Ma and Changjian Liu and Wanli Chen and Dalong Shi and Qiang Fu and Heyuan Shi},
booktitle = {FSE},
year = {2026},
doi = {10.1145/3803437.3806407}
}