Fuzzing OPC UA with AFLNet, ChatAFL and LibAFLstar: A Research Experience Paper

OPC UA (IEC 62541) is a protocol used in industrial control systems and building automations. The protocol is intrinsically stateful. In fact, it involves session handshakes, secure channels, and subscriptions. Its statefulness makes standard (stateless) fuzzers inefficient in finding bugs that rely deeply on the state model. In this paper, we present our practical experience in fuzzing the OPC UA protocol using three stateful fuzzers, namely AFLNet, ChatAFL, and LibAFLstar. For each fuzzer, we explain how to prepare the harness, collect the inputs, and run them. We compare the fuzzers on four different metrics: setup complexity, edge coverage, execution throughput, and time to find the first bug. Moreover, we present the steps to add a new case study (FreeOpcUA) to ProFuzzBench, a benchmarking framework widely used to compare the effectiveness of stateful fuzzers. Our experiments show that AFLNet is the easiest to configure, achieving solid coverage and fastest bug discovery. ChatAFL slightly improves coverage using LLM-expanded seeds with similar integration effort. LibAFLstar, while requiring the most setup effort, achieves the highest throughput across three tested configurations, but paradoxically the worst performance. In fact, we found that higher throughput does not translate into better bug finding and coverage without properly handling protocol complexities like sequence numbers. This experience paper presents the challenges, limitations, and performance trade-offs of each fuzzer, providing actionable guidance for researchers and practitioners seeking to apply stateful fuzzing to complex industrial protocols.

IEEE PICOM 2025