{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,7,23]],"date-time":"2026-07-23T08:03:12Z","timestamp":1784793792278,"version":"3.55.0"},"publisher-location":"Cham","reference-count":38,"publisher":"Springer Nature Switzerland","isbn-type":[{"value":"9783032325181","type":"print"},{"value":"9783032325198","type":"electronic"}],"license":[{"start":{"date-parts":[[2026,1,1]],"date-time":"2026-01-01T00:00:00Z","timestamp":1767225600000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0"},{"start":{"date-parts":[[2026,7,24]],"date-time":"2026-07-24T00:00:00Z","timestamp":1784851200000},"content-version":"vor","delay-in-days":204,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0"}],"content-domain":{"domain":["link.springer.com"],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2026]]},"abstract":"<jats:title>Abstract<\/jats:title>\n                  <jats:p>\n                    In recent years, protocol state fuzzing has emerged as an effective technique to analyze and test network protocol implementations, uncovering numerous security vulnerabilities, bugs, and non-conformance issues in them. This paper presents\n                    <jats:sc>ProtocolState-Fuzzer<\/jats:sc>\n                    (\n                    <jats:sc>PSF<\/jats:sc>\n                    ), an open source, generic, modular, and extensible framework for state machine learning and testing of network protocol implementations. We describe the distinctive features and support that\n                    <jats:sc>PSF<\/jats:sc>\n                    offers, its architecture and implementation, and briefly overview the protocol-specific state fuzzers that currently use\n                    <jats:sc>PSF<\/jats:sc>\n                    as their basis.\n                  <\/jats:p>","DOI":"10.1007\/978-3-032-32519-8_9","type":"book-chapter","created":{"date-parts":[[2026,7,23]],"date-time":"2026-07-23T07:18:31Z","timestamp":1784791111000},"page":"167-180","update-policy":"https:\/\/doi.org\/10.1007\/springer_crossmark_policy","source":"Crossref","is-referenced-by-count":0,"title":["PSF: A Generic and\u00a0Extensible Framework for\u00a0Protocol State Fuzzing"],"prefix":"10.1007","author":[{"ORCID":"https:\/\/orcid.org\/0000-0001-9657-0179","authenticated-orcid":false,"given":"Konstantinos","family":"Sagonas","sequence":"first","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0009-0003-1054-4853","authenticated-orcid":false,"given":"Thanos","family":"Typaldos","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"297","published-online":{"date-parts":[[2026,7,24]]},"reference":[{"issue":"2","key":"9_CR1","doi-asserted-by":"publisher","first-page":"87","DOI":"10.1016\/0890-5401(87)90052-6","volume":"75","author":"D Angluin","year":"1987","unstructured":"Angluin, D.: Learning regular sets from queries and counterexamples. Inf. Comput. 75(2), 87\u2013106 (1987). https:\/\/doi.org\/10.1016\/0890-5401(87)90052-6","journal-title":"Inf. Comput."},{"key":"9_CR2","doi-asserted-by":"publisher","unstructured":"Argyros, G., Stais, I., Jana, S., Keromytis, A.D., Kiayias, A.: SFADiff: automated evasion attacks and fingerprinting using black-box differential automata learning. In: Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security, pp. 1690\u20131701. ACM (2016). https:\/\/doi.org\/10.1145\/2976749.2978383","DOI":"10.1145\/2976749.2978383"},{"key":"9_CR3","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"250","DOI":"10.1007\/978-3-319-10431-7_18","volume-title":"Software Engineering and Formal Methods","author":"S Cassel","year":"2014","unstructured":"Cassel, S., Howar, F., Jonsson, B., Steffen, B.: Learning extended finite state machines. In: Giannakopoulou, D., Sala\u00fcn, G. (eds.) SEFM 2014. LNCS, vol. 8702, pp. 250\u2013264. Springer, Cham (2014). https:\/\/doi.org\/10.1007\/978-3-319-10431-7_18"},{"key":"9_CR4","doi-asserted-by":"publisher","unstructured":"Chen, N., Fiter\u0103u-Bro\u015ftean, P., Sagonas, K.: State fuzzing DTLS 1.3 implementations. In: 2025 IEEE Conference on Standards for Communications and Networking, pp. 426\u2013432. CSCN 2025, IEEE (2025). https:\/\/doi.org\/10.1109\/CSCN67557.2025.11230763","DOI":"10.1109\/CSCN67557.2025.11230763"},{"key":"9_CR5","doi-asserted-by":"publisher","unstructured":"Chow, T.S.: Testing software design modeled by finite-state machines. IEEE Trans. Softw. Eng. SE-4(3), 178\u2013187 (1978). https:\/\/doi.org\/10.1109\/TSE.1978.231496","DOI":"10.1109\/TSE.1978.231496"},{"key":"9_CR6","doi-asserted-by":"publisher","unstructured":"Daniel, L.A., Poll, E., de\u00a0Ruiter, J.: Inferring OpenVPN state machines using protocol state fuzzing. In: IEEE European Symposium on Security and Privacy (EuroS&P) Workshops, pp. 11\u201319. IEEE (2018). https:\/\/doi.org\/10.1109\/EuroSPW.2018.00009","DOI":"10.1109\/EuroSPW.2018.00009"},{"key":"9_CR7","doi-asserted-by":"publisher","unstructured":"Dierl, S., Fiterau-Brostean, P., Howar, F., Jonsson, B., Sagonas, K., T\u00e5quist, F.: Scalable tree-based register automata learning. In: Finkbeiner, B., Kov\u00e1cs, L. (eds.) Tools and Algorithms for the Construction and Analysis of Systems. LNCS, vol. 14571, pp. 87\u2013108. Springer, Cham (2024). https:\/\/doi.org\/10.1007\/978-3-031-57249-4_5","DOI":"10.1007\/978-3-031-57249-4_5"},{"key":"9_CR8","doi-asserted-by":"publisher","unstructured":"Ferreira, T., Brewton, H., D\u2019Antoni, L., Silva, A.: Prognosis: closed-box analysis of network protocol implementations. In: Proceedings of the ACM SIGCOMM 2021 Conference, pp. 762\u2013774. SIGCOMM \u201921, ACM, New York, NY, USA (2021). https:\/\/doi.org\/10.1145\/3452296.3472938","DOI":"10.1145\/3452296.3472938"},{"key":"9_CR9","unstructured":"Fiterau-Brostean, P., Jonsson, B., Merget, R., de\u00a0Ruiter, J., Sagonas, K., Somorovsky, J.: Analysis of DTLS implementations using protocol state fuzzing. In: 29th USENIX Security Symposium, pp. 2523\u20132540. USENIX Security 20, USENIX Association (2020). https:\/\/www.usenix.org\/conference\/usenixsecurity20\/presentation\/fiterau-brostean"},{"key":"9_CR10","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"454","DOI":"10.1007\/978-3-319-41540-6_25","volume-title":"Computer Aided Verification","author":"P Fiter\u0103u-Bro\u015ftean","year":"2016","unstructured":"Fiter\u0103u-Bro\u015ftean, P., Janssen, R., Vaandrager, F.: Combining model learning and model checking to analyze TCP implementations. In: Chaudhuri, S., Farzan, A. (eds.) CAV 2016. LNCS, vol. 9780, pp. 454\u2013471. Springer, Cham (2016). https:\/\/doi.org\/10.1007\/978-3-319-41540-6_25"},{"key":"9_CR11","doi-asserted-by":"crossref","unstructured":"Fiter\u0103u-Bro\u015ftean, P., Jonsson, B., Sagonas, K., T\u00e5quist, F.: DTLS-Fuzzer: a DTLS protocol state fuzzer. In: 15th IEEE Conference on Software Testing, Verification and Validation, pp. 456\u2013458. ICST 2022, IEEE (2022). DOIurlhttps:\/\/doi.org\/10.1109\/ICST53961.2022.00051","DOI":"10.1109\/ICST53961.2022.00051"},{"key":"9_CR12","doi-asserted-by":"publisher","unstructured":"Fiter\u0103u-Bro\u015ftean, P., Jonsson, B., Sagonas, K., T\u00e5quist, F.: Automata-based automated detection of state machine bugs in protocol implementations. In: 30th Annual Network and Distributed System Security Symposium. NDSS 2023, The Internet Society (2023). https:\/\/doi.org\/10.14722\/ndss.2023.23068","DOI":"10.14722\/ndss.2023.23068"},{"key":"9_CR13","doi-asserted-by":"publisher","unstructured":"Fiter\u0103u-Bro\u015ftean, P., Jonsson, B., Sagonas, K., T\u00e5quist, F.: SMBugFinder: an automated framework for testing protocol implementations for state machine bugs. In: Proceedings of the 33rd ACM SIGSOFT International Symposium on Software Testing and Analysis, pp. 1866\u20131870. ISSTA 2024, ACM, New York, NY, USA (2024). https:\/\/doi.org\/10.1145\/3650212.3685310","DOI":"10.1145\/3650212.3685310"},{"key":"9_CR14","doi-asserted-by":"publisher","unstructured":"Fiter\u0103u-Bro\u015ftean, P., Lenaerts, T., de\u00a0Ruiter, J., Poll, E., Vaandrager, F.W., Verleg, P.: Model learning and model checking of SSH implementations. In: Proceedings of the 24th ACM SIGSOFT International SPIN Symposium on Model Checking of Software, pp. 142\u2013151. SPIN 2017, ACM, New York, NY, USA (2017). https:\/\/doi.org\/10.1145\/3092282.3092289","DOI":"10.1145\/3092282.3092289"},{"key":"9_CR15","doi-asserted-by":"publisher","unstructured":"Frohme, M., Howar, F., Steffen, B.: LearnLib: 10 years later. In: Piskac, R., Rakamari\u0107, Z. (eds.) Computer Aided Verification - 37th International Conference, CAV 2025. LNCS, vol. 15934, pp. 141\u2013160. Springer, Cham (2025). https:\/\/doi.org\/10.1007\/978-3-031-98685-7_7","DOI":"10.1007\/978-3-031-98685-7_7"},{"issue":"6","key":"9_CR16","doi-asserted-by":"publisher","first-page":"591","DOI":"10.1109\/32.87284","volume":"17","author":"S Fujiwara","year":"1991","unstructured":"Fujiwara, S., von Bochmann, G., Khendek, F., Amalou, M., Ghedamsi, A.: Test selection based on finite state models. IEEE Trans. Softw. Eng. 17(6), 591\u2013603 (1991). https:\/\/doi.org\/10.1109\/32.87284","journal-title":"IEEE Trans. Softw. Eng."},{"key":"9_CR17","doi-asserted-by":"publisher","first-page":"171322","DOI":"10.1109\/ACCESS.2019.2956062","volume":"7","author":"J Guo","year":"2019","unstructured":"Guo, J., Gu, C., Chen, X., Wei, F.: Model learning and model checking of IPSec implementations for Internet of Things. IEEE Access 7, 171322\u2013171332 (2019). https:\/\/doi.org\/10.1109\/ACCESS.2019.2956062","journal-title":"IEEE Access"},{"key":"9_CR18","doi-asserted-by":"publisher","unstructured":"Hussain, S.R., Karim, I., Ishtiaq, A.A., Chowdhury, O., Bertino, E.: Noncompliance as deviant behavior: an automated black-box noncompliance checker for 4G LTE cellular devices. In: Kim, Y., Kim, J., Vigna, G., Shi, E. (eds.) Proceedings of the 2021 ACM SIGSAC Conference on Computer and Communications Security. CCS 2021, pp. 1082\u20131099. ACM (2021). https:\/\/doi.org\/10.1145\/3460120.3485388","DOI":"10.1145\/3460120.3485388"},{"key":"9_CR19","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"307","DOI":"10.1007\/978-3-319-11164-3_26","volume-title":"Runtime Verification","author":"M Isberner","year":"2014","unstructured":"Isberner, M., Howar, F., Steffen, B.: The TTT algorithm: a redundancy-free approach to active automata learning. In: Bonakdarpour, B., Smolka, S.A. (eds.) RV 2014. LNCS, vol. 8734, pp. 307\u2013322. Springer, Cham (2014). https:\/\/doi.org\/10.1007\/978-3-319-11164-3_26"},{"key":"9_CR20","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"487","DOI":"10.1007\/978-3-319-21690-4_32","volume-title":"Computer Aided Verification","author":"M Isberner","year":"2015","unstructured":"Isberner, M., Howar, F., Steffen, B.: The open-source LearnLib. In: Kroening, D., P\u0103s\u0103reanu, C.S. (eds.) CAV 2015. LNCS, vol. 9206, pp. 487\u2013495. Springer, Cham (2015). https:\/\/doi.org\/10.1007\/978-3-319-21690-4_32"},{"key":"9_CR21","doi-asserted-by":"publisher","unstructured":"Kearns, M.J., Vazirani, U.: An Introduction to Computational Learning Theory. The MIT Press (1994). https:\/\/doi.org\/10.7551\/mitpress\/3897.001.0001","DOI":"10.7551\/mitpress\/3897.001.0001"},{"key":"9_CR22","unstructured":"Maehren, M., Erinola, N., Merget, R., Schwenk, J., Somorovsky, J.: Towards internet-based state learning of TLS state machines. In: 34th USENIX Security Symposium. pp. 7097\u20137116. USENIX Security 25, Seattle, WA (2025). https:\/\/www.usenix.org\/conference\/usenixsecurity25\/presentation\/maehren"},{"key":"9_CR23","unstructured":"Moon, S.J., et al.: Alembic: automated model inference for stateful network functions. In: 16th USENIX Symposium on Networked Systems Design and Implementation (NSDI 19), pp. 699\u2013718. USENIX Association (2019). https:\/\/www.usenix.org\/conference\/nsdi19\/presentation\/moon"},{"key":"9_CR24","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"67","DOI":"10.1007\/978-3-030-88885-5_5","volume-title":"Automated Technology for Verification and Analysis","author":"E Mu\u0161kardin","year":"2021","unstructured":"Mu\u0161kardin, E., Aichernig, B.K., Pill, I., Pferscher, A., Tappler, M.: AALpy: an active automata learning library. In: Hou, Z., Ganesh, V. (eds.) ATVA 2021. LNCS, vol. 12971, pp. 67\u201373. Springer, Cham (2021). https:\/\/doi.org\/10.1007\/978-3-030-88885-5_5"},{"key":"9_CR25","doi-asserted-by":"publisher","unstructured":"Peled, D.A., Vardi, M.Y., Yannakakis, M.: Black box checking. J. Autom. Lang. Comb. 7(2), 225\u2013246 (2002). https:\/\/doi.org\/10.25596\/jalc-2002-225","DOI":"10.25596\/jalc-2002-225"},{"issue":"1","key":"9_CR26","doi-asserted-by":"publisher","first-page":"35","DOI":"10.1007\/S10703-023-00425-Y","volume":"61","author":"A Pferscher","year":"2022","unstructured":"Pferscher, A., Aichernig, B.K.: Fingerprinting and analysis of Bluetooth devices with automata learning. Formal Methods Syst. Des. 61(1), 35\u201362 (2022). https:\/\/doi.org\/10.1007\/S10703-023-00425-Y","journal-title":"Formal Methods Syst. Des."},{"issue":"4","key":"9_CR27","doi-asserted-by":"publisher","first-page":"307","DOI":"10.1007\/s10009-009-0120-7","volume":"11","author":"H Raffelt","year":"2009","unstructured":"Raffelt, H., Merten, M., Steffen, B., Margaria, T.: Dynamic testing via automata learning. Int. J. Softw. Tools Technol. Transf. 11(4), 307\u2013324 (2009). https:\/\/doi.org\/10.1007\/s10009-009-0120-7","journal-title":"Int. J. Softw. Tools Technol. Transf."},{"key":"9_CR28","doi-asserted-by":"publisher","unstructured":"Rasoamanana, A.T., Levillain, O., Debar, H.: Towards a systematic and automatic use of state machine inference to uncover security flaws and fingerprint TLS stacks. In: 27th European Symposium on Research in Computer Security (ESORICS). LNCS, vol. 13556, pp. 637\u2013657. Springer, Cham (2022). https:\/\/doi.org\/10.1007\/978-3-031-17143-7_31","DOI":"10.1007\/978-3-031-17143-7_31"},{"key":"9_CR29","doi-asserted-by":"publisher","unstructured":"Rasool, A., Alp\u00e1r, G., de\u00a0Ruiter, J.: State machine inference of quic (2019). https:\/\/doi.org\/10.48550\/arXiv.1903.04384","DOI":"10.48550\/arXiv.1903.04384"},{"issue":"2","key":"9_CR30","doi-asserted-by":"publisher","first-page":"299","DOI":"10.1006\/inco.1993.1021","volume":"103","author":"RL Rivest","year":"1993","unstructured":"Rivest, R.L., Schapire, R.E.: Inference of finite automata using homing sequences. Inf. Comput. 103(2), 299\u2013347 (1993). https:\/\/doi.org\/10.1006\/inco.1993.1021","journal-title":"Inf. Comput."},{"key":"9_CR31","unstructured":"de\u00a0Ruiter, J., Poll, E.: Protocol state fuzzing of TLS implementations. In: 24th USENIX Security Symposium, pp. 193\u2013206. USENIX Security 15, USENIX Association, Washington, D.C. (2015). https:\/\/www.usenix.org\/conference\/usenixsecurity15\/technical-sessions\/presentation\/de-ruiter"},{"key":"9_CR32","doi-asserted-by":"publisher","unstructured":"Sagonas, K., Typaldos, T.: EDHOC-Fuzzer: an EDHOC protocol state fuzzer. In: Proceedings of the 32nd ACM SIGSOFT International Symposium on Software Testing and Analysis, pp. 1495\u20131498. ISSTA 2023, ACM, New York, NY, USA (2023). https:\/\/doi.org\/10.1145\/3597926.3604922","DOI":"10.1145\/3597926.3604922"},{"key":"9_CR33","doi-asserted-by":"publisher","unstructured":"Sagonas, K., Typaldos, T.: Artifact for CAV\u20192026 tool paper \u201cPSF: a generic and extensible framework for protocol state fuzzing\u201d (2026). https:\/\/doi.org\/10.5281\/zenodo.19831626","DOI":"10.5281\/zenodo.19831626"},{"key":"9_CR34","unstructured":"Schnor, H.: Using Protocol State Fuzzing to Test Bluetooth Low Energy Implementations. Master\u2019s thesis, Department of Information Technology, Uppsala University, Sweden (2025). https:\/\/urn.kb.se\/resolve?urn=urn:nbn:se:uu:diva-565565"},{"key":"9_CR35","doi-asserted-by":"publisher","unstructured":"Selander, G., Mattsson, J.P., Palombini, F.: Ephemeral Diffie-Hellman over COSE (EDHOC). RFC 9528 (2024). https:\/\/doi.org\/10.17487\/RFC9528, https:\/\/www.rfc-editor.org\/info\/rfc9528","DOI":"10.17487\/RFC9528"},{"key":"9_CR36","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"256","DOI":"10.1007\/978-3-642-21455-4_8","volume-title":"Formal Methods for Eternal Networked Software Systems","author":"B Steffen","year":"2011","unstructured":"Steffen, B., Howar, F., Merten, M.: Introduction to active automata learning from a practical perspective. In: Bernardo, M., Issarny, V. (eds.) SFM 2011. LNCS, vol. 6659, pp. 256\u2013296. Springer, Heidelberg (2011). https:\/\/doi.org\/10.1007\/978-3-642-21455-4_8"},{"key":"9_CR37","doi-asserted-by":"publisher","unstructured":"Tappler, M., Aichernig, B.K., Bloem, R.: Model-based testing IoT communication via active automata learning. In: IEEE International Conference on Software Testing, Verification and Validation, pp. 276\u2013287. ICST 2017, IEEE (2017). https:\/\/doi.org\/10.1109\/ICST.2017.32","DOI":"10.1109\/ICST.2017.32"},{"issue":"2","key":"9_CR38","doi-asserted-by":"publisher","first-page":"86","DOI":"10.1145\/2967606","volume":"60","author":"F Vaandrager","year":"2017","unstructured":"Vaandrager, F.: Model learning. Commun. ACM 60(2), 86\u201395 (2017). https:\/\/doi.org\/10.1145\/2967606","journal-title":"Commun. ACM"}],"container-title":["Lecture Notes in Computer Science","Computer Aided Verification"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/978-3-032-32519-8_9","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,7,23]],"date-time":"2026-07-23T07:18:34Z","timestamp":1784791114000},"score":1,"resource":{"primary":{"URL":"https:\/\/link.springer.com\/10.1007\/978-3-032-32519-8_9"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026]]},"ISBN":["9783032325181","9783032325198"],"references-count":38,"URL":"https:\/\/doi.org\/10.1007\/978-3-032-32519-8_9","relation":{},"ISSN":["0302-9743","1611-3349"],"issn-type":[{"value":"0302-9743","type":"print"},{"value":"1611-3349","type":"electronic"}],"subject":[],"published":{"date-parts":[[2026]]},"assertion":[{"value":"24 July 2026","order":1,"name":"first_online","label":"First Online","group":{"name":"ChapterHistory","label":"Chapter History"}},{"value":"The authors have no competing interests to declare that are relevant to the content of this article.","order":1,"name":"Ethics","label":"Disclosure of Interests","group":{"name":"EthicsHeading","label":"Ethics"}},{"value":"CAV","order":1,"name":"conference_acronym","label":"Conference Acronym","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"International Conference on Computer Aided Verification","order":2,"name":"conference_name","label":"Conference Name","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"Lisbon","order":3,"name":"conference_city","label":"Conference City","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"Portugal","order":4,"name":"conference_country","label":"Conference Country","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"2026","order":5,"name":"conference_year","label":"Conference Year","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"26 July 2026","order":7,"name":"conference_start_date","label":"Conference Start Date","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"29 July 2026","order":8,"name":"conference_end_date","label":"Conference End Date","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"38","order":9,"name":"conference_number","label":"Conference Number","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"cav2026","order":10,"name":"conference_id","label":"Conference ID","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"https:\/\/www.floc26.org\/program","order":11,"name":"conference_url","label":"Conference URL","group":{"name":"ConferenceInfo","label":"Conference Information"}}]}}