Real-world Programs Research Articles

AI-driven health data analytics for early detection of infectious diseases: A conceptual exploration of U.S. public health strategies

This review paper explores the role of AI-driven health data analytics in enhancing the early detection and response to infectious diseases within U.S. public health strategies. It begins by outlining the importance of timely detection in controlling outbreaks and discusses current public health systems and their limitations, including passive surveillance and data fragmentation. The paper highlights innovative AI technologies such as machine learning, natural language processing, and predictive modeling, which can significantly improve disease monitoring and forecasting. By analyzing vast datasets in real time, these technologies facilitate quicker identification of emerging health threats and enable tailored public health responses. Furthermore, the review presents recommendations for integrating AI innovations into existing public health strategies, emphasizing improved data interoperability, investment in infrastructure, stakeholder collaboration, community engagement, and real-world pilot programs. Ultimately, the findings underscore the potential of AI-driven health data analytics to transform infectious disease management, thereby safeguarding public health.

Symbolic execution of floating-point programs: How far are we?

Floating-point programs are challenging for symbolic execution due to the constraint solving problem. This paper empirically studies five existing symbolic execution methods for floating-point programs to evaluate their effectiveness and limitations. We have implemented the existing methods based on the state-of-the-art symbolic execution tool KLEE and constructed a real-world floating-point program benchmark for evaluation. We evaluate the existing methods with respect to statement coverage and the ability to detect floating-point exceptions. The results demonstrate that the existing methods complement each other. Based on the evaluation results, we propose a synergistic approach to improving the efficiency of the symbolic execution for floating-point programs. The experimental results indicate our synergistic method’s effectiveness in finding floating-point exceptions.

FunFuzz : Greybox Fuzzing with Function Significance

Greybox fuzzing is dedicated to revealing software bugs by maximizing code coverage. Concentrating on code coverage, greybox fuzzing effectively exposes bugs in real-world programs by continuously executing the program under test (PUT) with the test inputs generated from initial seeds, making it a popular software testing technique. Although powerful, the effectiveness of greybox fuzzing can be restricted in some cases. Ignoring the significant degrees of executed functions, traditional greybox fuzzing usually fails to identify significant seeds that execute more significant functions, and thus may assign similar energy to significant and trivial seeds when conducting power scheduling. As a result, the effectiveness of greybox fuzzing can be degraded due to wasting too much energy on trivial seeds. In this paper, we introduce function significance (FS) to measure the significant degrees of functions. Our key insight is that the influential functions that connect to many other functions are significant to greybox fuzzing as they provide more probabilities to reach previously unexplored code regions. To quantify FS, we conduct influence analysis upon the call graphs extracted from the PUTs to obtain the centrality values of function nodes. With FS as the significance measurement, we further propose FunFuzz , an FS-aware greybox fuzzing technique, to optimize significant seeds and tackle the aforementioned restriction. To this end, FunFuzz dynamically tracks the functions executed by a seed during fuzzing, and computes the significance score for the seed by accumulating the FS values of the functions executed by it. Based on the computed FS values, FunFuzz then takes an estimation-based power scheduling to assign more (or less) energy to seeds that achieve over-estimated (or under-estimated) significance scores. Specifically, the seed energy is adjusted by multiplying with a scale factor computed regarding the ratio of the actual significance score achieved by executing the seed and the estimated significance score predicted by a linear model constructed on-the-fly. To evaluate FunFuzz , we prototype it on top of AFL++ and conduct experiments with 15 programs, of which 10 are from common real-world projects and five are from Magma, and compare it to seven popular fuzzers. The experimental results obtained through fuzzing exceeding 40,800 CPU hours show that: (1) In terms of covering code, FunFuzz outperforms AFL++ by achieving 0.1% \(\sim\) 18.4% more region coverage on 13 out of 15 targets. (2) In terms of finding bugs, FunFuzz unveils 114 unique crashes and 25 Magma bugs (which are derived from CVEs) in 20 trials of 24-hour fuzzing, which are the most compared to the competitor fuzzers and include 32 crashes and 1 Magma bug that the other fuzzers fail to discover. Besides the experiments focusing on code coverage and bug finding, we evaluate the key components of FunFuzz , namely the FS-centered estimation-based power scheduling and the lazy FS computation mechanism. The extensive evaluation not only suggests FunFuzz ’s superiority in code coverage and bug finding, but also demonstrates the effectiveness of the two components.

Beyond The Basics: A Detailed Survey of Advanced Python Applications and Innovations

Abstract: Python is the general purpose, high-level, scriptable, interpreted, object oriented and easy to learn language was developed by Guido van Rossum. Python is a popular programming language because of its simplicity, ease of use, open-source licensing, and accessibility. It provides various libraries and frameworks for learning and real world programming. Python’s versatility and active community make it an ideal language for Machine Learning, Data Science, Artificial Intelligence, Networking, Game Development, Web Development and various other domains. In this paper, we will provide an introduction to the main Python programming software tools used for Web development, Data science, Machine learning techniques, Educational Development, etc. In this paper will first introduce Python as a language, and give introduction about Web Development, Data science, Machine learning, Educational Development & Financial Analysis and then describe packages that are popular in that sector

Shining Light on the Inter-procedural Code Obfuscation: Keep Pace with Progress in Binary Diffing

Software obfuscation techniques have lost their effectiveness due to the rapid development of binary diffing techniques, which can achieve accurate function matching and identification. In this paper, we propose a new inter-procedural code obfuscation mechanism KHaos , which moves the code across functions to obfuscate the function by using compilation optimizations. Three obfuscation primitives are proposed to separate, aggregate, and hide the function. They can be combined to enhance the obfuscation effect further. This paper also reveals distinguishing factors on obfuscation and compiler optimization and presents novel observations to gain insights into the impact of actively utilizing compiler optimization in obfuscation. A prototype of KHaos is implemented and evaluated on a large number of real-world programs. Experimental results show that KHaos outperforms existing code obfuscations and can significantly reduce the accuracy rates of six state-of-the-art binary diffing techniques with lower runtime overhead.

FormatAEG: a framework for bypassing ASLR defense and automated exploitation of format string vulnerability

Abstract The format string vulnerability is a common software vulnerability. A well-constructed format string can read and modify arbitrary memory addresses, causing serious system problems. Existing automated exploit generation solutions for format string vulnerability are unable to cope with the limitations imposed by the vulnerability defense mechanism Address Space Layout Randomization (ASLR) and the program itself on vulnerability exploitation. In this paper, to address the above challenges, we propose FormatAEG, the first automatic exploitation framework for format string vulnerabilities that can bypass ASLR defense and the program's own constraints. Specifically, we first proposed an arbitrary address reading and writing method based on a format string vulnerability, which can modify the target address data by directly arranging the target address or automatically searching and utilizing the pointer chain in the stack. Then, we propose a vulnerability reentry method based on global offset table (GOT) hijacking, which hijacks the program control flow by modifying function addresses in the GOT, making the vulnerability reentrant. In the experimental section, we evaluated FormatAEG using 20 Capture The Flag programs from top international tournaments and two real-world programs with format string vulnerabilities. The evaluation results show that with ASLR defense turned on, FormatAEG successfully detects format string vulnerability in 19 of these programs and generates exploit code for 15 of them. Compared with existing tools, FormatAEG detected 11 more format string vulnerabilities and generated 13 more exploit codes.

MEA2: A Lightweight Field-Sensitive Escape Analysis with Points-to Calculation for Golang

Escape analysis plays a crucial role in garbage-collected languages as it enables the allocation of non-escaping variables on the stack by identifying the dynamic lifetimes of objects and pointers. This helps in reducing heap allocations and alleviating garbage collection pressure. However, Go, as a garbage-collected language, employs a fast yet conservative escape analysis, which is field-insensitive and omits point-to-set calculation to expedite compilation. This results in more variables being allocated on the heap. Empirical statistics reveal that field access and indirect memory access are prevalent in real-world Go programs, suggesting potential opportunities for escape analysis to enhance program performance. In this paper, we propose MEA 2 , an escape analysis framework atop GoLLVM (an LLVM-based Go compiler), which combines field sensitivity and points-to analysis. Moreover, a novel generic function summary representation is designed to facilitate fast inter-procedural analysis. We evaluated it by using MEA 2 to perform stack allocation in 12 wildly-use open-source projects. The results show that, compared to Go’s escape analysis, MEA 2 can reduce heap allocation sites by 7.9

Computing Precise Control Interface Specifications

Verifying network programs is challenging because of how they divide labor: the control plane computes high level routes through the network and compiles them to device configurations, while the data plane uses these configurations to realize the desired forwarding behavior. In practice, the correctness of the data plane often assumes that the configurations generated by the control plane will satisfy complex specifications. Consequently, validation tools such as program verifiers, runtime monitors, fuzzers, and test-case generators must be aware of these control interface specifications (ci-specs) to avoid raising false alarms. In this paper, we propose the first algorithm for computing precise ci-specs for network data planes. Our specifications are designed to be efficiently monitorable —concretely, checking that a fixed configuration satisfies a ci-spec can be done in polynomial time. Our algorithm, based on modular program instrumentation, quantifier elimination, and a path-based analysis, is more expressive than prior work, and is applicable to practical network programs. We describe an implementation and show that ci-specs computed by our tool are useful for finding real bugs in real-world data plane programs.

Impact of real-world remote symptom monitoring program on hospitalizations and ICU admissions.

377 Background: Previous randomized controlled trials have demonstrated benefits to patients from remote symptom monitoring (RSM) with electronic patient-reported outcomes (ePROs) including healthcare utilization. However, less is known about the impact of RSM in diverse, real-world populations. Methods: This cross-sectional analysis from a hybrid, type 2 implementation-effectiveness trial evaluated the impact of RSM on healthcare utilization amongst patients with cancer receiving chemotherapy, immunotherapy, monoclonal antibody, or targeted therapy at two academiccancer centers in the Southeastern United States. Modified Poisson regression models with robust standard error and 95% confidence interval (CI) was used to calculate the relative risk (RR) of any hospital or ICU utilization between patients receiving RSM and controls for 3 and 6 months after index date. Models were controlled for age at index, race, sex, cancer type, cancer stage, insurance, prior treatment, comorbidities, RUCA, and follow-up during COVID-19 pandemic. Additional logistic regression models were used to estimate odds ratios (OR) for subset analysis stratified by race (Black or African American, Other, or White), rurality using Rural-Urban Commuting Area Codes, and neighborhood disadvantage using Area Deprivation Index (ADI). Results: From 5/2021-2/2024, 1215 patients were enrolled in RSM; 27% were Black, 16% lived in a rural area, and 25% lived in an area with high neighborhood disadvantage. The populations receiving RSM were similar to the control population (n = 4559); 26% were Black, 22% lived in a rural area, and 28% lived in area with high neighborhood disadvantage. The unadjusted relative risk of hospitalization for patients receiving RSM and control patients were 0.70 (95% CI, 0.63-0.70) and 0.77 (95% CI, 0.71-0.85), respectively. In adjusted analyses, hospitalizations were lower amongst patients receiving RSM compared to control patients with a RR of 0.82 (95% CI 0.73-0.92). Similar patterns were observed for ICU admissions (RR 0.59; 95% CI,0.40-0.88). Analysis by patient subgroup was similar to the overall analysis. A lower odd of hospitalizations and ICU admissions at 6 months was observed across all subset analyses: Black vs. White patients (OR 0.80; OR 0.48); rural vs. urban patients (OR 0.78; OR 0.68); and patients living in areas of high vs. lower neighborhood disadvantage (OR 0.59; OR 0.33). Conclusions: The use of RSM amongst patients receiving treatment for cancer is associated with reductions in hospitalizations and ICU admissions in real-world, diverse settings. Further work to expand this intervention nationally is needed. Clinical trial information: NCT04809740 .

ROPGMN: Effective ROP and variants discovery using dynamic feature and graph matching network

Return Oriented Programming (ROP) is one of the most challenging threats to operating systems. Traditional detection and defense techniques for ROP such as stack protection, address randomization, compiler optimization, control flow integrity, and basic block thresholds have certain limitations in accuracy or efficiency. At the same time, they cannot effectively detect ROP variant attacks, such as COP, COOP, JOP. In this paper, we propose a novel ROP and its variants detection approach that first filters the normal execution flow according to four strategies provided and then adopts Graph Matching Network (GMN) to determine whether there is ROP or its variant attack. Moreover, we developed a prototype named ROPGMN with shared memory to solve cross-language and cross-process problems. Using real-world vulnerable programs and constructed programs with dangerous function calls, we conduct extensive experiments with 6 ROP detectors to evaluate ROPGMN. The experimental results demonstrate the effectiveness of ROPGMN in discovering ROPs and their variant attacks with low performance overhead.

A fine-grained approach for Android taint analysis based on labeled taint value graphs

Static taint analysis is a widely used method to identify vulnerabilities in Android applications. However, the existing tools for static analysis often struggle with processing times, particularly when dealing with complex real-world programs. To reduce time consumption, some tools choose to sacrifice analytical precision, e.g., FastDroid sets an upper limit for analysis iterations in Android applications. In this paper, we propose a labeled taint value graph (LTVG) to store taint flows, and implement a fine-grained analysis tool called LabeledDroid. This graph is constructed based on the taint value graph (TVG) of FastDroid, and takes into account both precision and time consumption. That is, we decompile an Android app into Jimple statements, develop fine-grained propagation rules to handle List, and construct LTVGs according to these rules. Afterwards, we traverse LTVGs to obtain high-precision taint flows. An analysis of 39 apps from the TaintBench benchmark shows that LabeledDroid is 0.87 s faster than FastDroid on average. Furthermore, if some common accuracy parameters are adapted in both LabeledDroid and FastDroid, the experiment demonstrates that the former is more scalable. Moreover, the maximum analysis time of LabeledDroid is less than 200 s and its average time is 46.25 s, while FastDroid sometimes experiences timeouts with durations longer than 600 s. Additionally, LabeledDroid achieves a precision of 70% in handling lists, while FastDroid and TaintSA achieve precisions of 38.9% and 41.2%, respectively.

Electric Vehicle Battery Remanufacturing: Circular Economy Leadership and Workforce Development

Given the increasing momentum globally towards sustainable transportation, the remanufacturing of used electric vehicle lithium-ion batteries (EV LIBs) emerges as a critical opportunity to promote the principles of the circular economy. Existing research highlights the significance of remanufacturing in resource conservation and waste reduction. Nevertheless, detailed insights into South Africa’s (SA’s) specific capabilities and strategic approaches in the context of used EV LIBs remain sparse. By utilizing in-depth interviews with fifteen key industry stakeholders and drawing on institutional theory, this qualitative study evaluates SA’s infrastructure, technical expertise, and regulatory frameworks in the EV LIB remanufacturing sector to address this gap. The findings reveal proactive strategies, including technical expertise, sustainable infrastructure, and robust regulatory frameworks aligned with global standards. This study proposes strategic initiatives like the Interdisciplinary Innovation Hub and Mobile Remanufacturing Labs, which are analytically derived from stakeholder insights and aim to predict potential pathways for workforce development, especially in rural areas. Innovative training programs, including the Virtual Reality Consortium, Circular Economy Institutes, and the Real-world Challenges Program, will ensure a skilled workforce committed to sustainability and circular economy principles. The conclusions highlight SA’s potential to become a leader in EV LIB remanufacturing by integrating circular economy principles, enhancing technical expertise, and fostering international collaboration.

GBSR: Graph-based suspiciousness refinement for improving fault localization

Fault Localization (FL) is an important and time-consuming phase of software debugging. The essence of FL lies in the process of calculating the suspiciousness of different program entities (e.g., statements) and generating a ranking list to guide developers in their code inspection. Nonetheless, a prevalent challenge within existing FL methodologies is the propensity for program entities with analogous execution information to receive a similar suspiciousness. This phenomenon can lead to confusion among developers, thereby reducing the effectiveness of debugging significantly. To alleviate this issue, we introduce fine-grained contextual information (such as partial code structural, coverage, and features from mutation analysis) to enrich the characteristics of program entities. Graphical structures are proposed to organize such information, where the passed and failed tests are constructed separately with the consideration of their differential impacts. In order to support the analysis of multidimensional features and the representation of large-scale programs, the PageRank algorithm is adopted to compute each program entity’s weight. Rather than altering the fundamental FL process, we leverage these computed weights to refine the suspiciousness produced by various FL techniques, thereby providing developers with a more precise and actionable ranking of potential fault locations. The proposed strategy Graph-Based Suspiciousness Refinement (GBSR) is evaluated on 243 real-world faulty programs from the Defects4J. The results demonstrate that GBSR can improve the accuracy of various FL techniques. Specifically, for the refinement with traditional SBFL and MBFL techniques, the number of faults localized by the first position of the ranking list (Top-1) is increased by 189% and 68%, respectively. Furthermore, GBSR can also boost the state-of-the-art learning-based FL technique Grace by achieving a 2.8% performance improvement in Top-1.

Hybrid deep learning models for the screening of Diabetic Macular Edema in optical coherence tomography volumes

Several studies published so far used highly selective image datasets from unclear sources to train computer vision models and that may lead to overestimated results, while those studies conducted in real-life remain scarce. To avoid image selection bias, we stacked convolutional and recurrent neural networks (CNN-RNN) to analyze complete optical coherence tomography (OCT) cubes in a row and predict diabetic macular edema (DME), in a real-world diabetic retinopathy screening program. A retrospective cohort study was carried out. Throughout 4-years, 5314 OCT cubes from 4408 subjects who attended to the diabetic retinopathy (DR) screening program were included. We arranged twenty-two (22) pre-trained CNNs in parallel with a bidirectional RNN layer stacked at the bottom, allowing the model to make a prediction for the whole OCT cube. The staff of retina experts built a ground truth of DME later used to train a set of these CNN-RNN models with different configurations. For each trained CNN-RNN model, we performed threshold tuning to find the optimal cut-off point for binary classification of DME. Finally, the best models were selected according to sensitivity, specificity, and area under the receiver operating characteristics curve (AUROC) with their 95% confidence intervals (95%CI). An ensemble of the best models was also explored. 5188 cubes were non-DME and 126 were DME. Three models achieved an AUROC of 0.94. Among these, sensitivity, and specificity (95%CI) ranged from 84.1–90.5 and 89.7–93.3, respectively, at threshold 1, from 89.7–92.1 and 80–83.1 at threshold 2, and from 80.2–81 and 93.8–97, at threshold 3. The ensemble model improved these results, and lower specificity was observed among subjects with sight-threatening DR. Analysis by age, gender, or grade of DME did not vary the performance of the models. CNN-RNN models showed high diagnostic accuracy for detecting DME in a real-world setting. This engine allowed us to detect extra-foveal DMEs commonly overlooked in other studies, and showed potential for application as the first filter of non-referable patients in an outpatient center within a population-based DR screening program, otherwise ended up in specialized care.

Speeding up Genetic Improvement via Regression Test Selection

Genetic Improvement (GI) uses search-based optimisation algorithms to automatically improve software with respect to both functional and non-functional properties. Our previous work showed that Regression Test Selection (RTS) can help speed up the use of GI and enhance the overall results while not affecting the software system’s validity. This article expands upon our investigation by answering further questions about safety and applying a GI algorithm based on Local Search (LS) in addition to the previously explored Genetic Programming (GP) approach. Further, we extend the number of subjects to 12 by analysing five larger real-world open-source programs. We empirically compare two state-of-the-art RTS techniques combined with GP and LS for these 12 programs. The results show that both RTS techniques are safe to use and can reduce the cost of GI by up to 80% and by 31% on average across programs. We also observe that both search-based algorithms impact the effectiveness gains of GI differently, and that various RTS strategies achieve differing gains in terms of efficiency. These results serve as further evidence that RTS must be used as a core component of the GI search process to maximise its effectiveness and efficiency.

Longitudinal experiences of Canadians receiving compassionate access to psilocybin-assisted psychotherapy

Recent clinical trials have found that the serotonergic psychedelic psilocybin effectively alleviates anxiodepressive symptoms in patients with life-threatening illnesses when given in a supportive environment. These outcomes prompted Canada to establish legal pathways for therapeutic access to psilocybin, coupled with psychological support. Despite over one-hundred Canadians receiving compassionate access since 2020, there has been little examination of these ‘real-world’ patients. We conducted a prospective longitudinal survey which focused on Canadians who were granted Section 56 exemptions for legal psilocybin-assisted psychotherapy. Surveys assessing various symptom dimensions were conducted at baseline, two weeks following the session (endpoint), and optionally one day post-session. Participant characteristics were examined using descriptive statistics, and paired sample t-tests were used to quantify changes from baseline to the two-week post-treatment endpoint. Eight participants with Section 56 exemptions (four females, Mage = 52.3 years), all with cancer diagnoses, fully completed baseline and endpoint surveys. Significant improvements in anxiety and depression symptoms, pain, fear of COVID-19, quality of life, and spiritual well-being were observed. Attitudes towards death, medical assistance in dying, and desire for hastened death remained unchanged. While most participants found the psilocybin sessions highly meaningful, if challenging, one reported a substantial decrease in well-being due to the experience. These preliminary data are amongst the first to suggest that psilocybin-assisted psychotherapy can produce psychiatric benefits in real-world patients akin to those observed in clinical trials. Limited enrollment and individual reports of negative experiences indicate the need for formal real-world evaluation programs to surveil the ongoing expansion of legal access to psychedelics.

Extending SysML Model Federation to Support Systems of Systems Multilevel Security Development

AbstractPractitioners of modern systems engineering within the defense industry and intelligence community often find themselves being pulled in diametrically opposed directions. On the one hand, systems engineering is quickly evolving into a digital practice, strategically connecting heterogeneous sets of models to form digital threads and digital twins capable of providing insights more valuable than the sum of their parts. On the other hand, the inherent nature of working within the national security space necessitates information be held a multiple levels of classification, safeguarded from release, and compartmentalized. This paper focuses on Model Based Systems Engineering (MBSE) development to introduce methods and tools to aid in overcoming these challenges. The work presented here builds on previously published works in SysML Model Federation for Systems of Systems (SoS) Architecting, the experience of applying this methodology on real world programs. Furthermore, it leverages freely available MBSE tools, processes, and methods in the construction of System Architecture Models (SAMs). This paper culminates in a call to action for additional published research and development to address residual challenges and gaps with respect to executing MBSE for Multilevel Security (MLS) development.

A Bayesian latent-subgroup platform design for dose optimization.

The US Food and Drug Administration launched Project Optimus to reform the dose optimization and dose selection paradigm in oncology drug development, calling for the paradigm shift from finding the maximum tolerated dose to the identification of optimal biological dose (OBD). Motivated by a real-world drug development program, we propose a master-protocol-based platform trial design to simultaneously identify OBDs of a new drug, combined with standards of care or other novel agents, in multiple indications. We propose a Bayesian latent subgroup model to accommodate the treatment heterogeneity across indications, and employ Bayesian hierarchical models to borrow information within subgroups. At each interim analysis, we update the subgroup membership and dose-toxicity and -efficacy estimates, as well as the estimate of the utility for risk-benefit tradeoff, based on the observed data across treatment arms to inform the arm-specific decision of dose escalation and de-escalation and identify the OBD for each arm of a combination partner and an indication. The simulation study shows that the proposed design has desirable operating characteristics, providing a highly flexible and efficient way for dose optimization. The design has great potential to shorten the drug development timeline, save costs by reducing overlapping infrastructure, and speed up regulatory approval.

Testing Error Handling Code With Software Fault Injection and Error-Coverage-Guided Fuzzing

Real-world programs require error handling code to handle various kinds of possible errors. However, these errors just infrequently occur due to special conditions, so error handling code is difficult to test. Coverage-guided fuzzing and software fault injection (SFI) are two common techniques that can test error handling code, but they still have major limitations. Specifically, existing fuzzing approaches generate program inputs guided by code coverage, but many occasional errors (such as insufficient memory) are unrelated to inputs, and code coverage cannot effectively reflect the execution contexts of these errors; existing SFI approaches often inject single or random faults, without exploring fault space or using program feedback. In this paper, we propose a new fuzzing framework named EH-Fuzz, to effectively test error handling code. EH-Fuzz uses a context-sensitive SFI-based fuzzing approach to explore fault space and perform fault injection, guided by a new metric named <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">error coverage</i> . We evaluate EH-Fuzz on 9 user-level programs and 6 kernel-level modules, and find 45 new real bugs, 31 of which have been confirmed and fixed. We compare EH-Fuzz to existing fuzzing approaches (including AFL, AFL++, Syzkaller, FIZZER and FIFUZZ), and EH-Fuzz finds many real bugs missed by these approaches with higher testing coverage.

Stateful black-box fuzzing for encryption protocols and its application in IPsec

Owing to the rapid development of information security technology, the security analysis of encryption protocols has received widespread attention. In this paper, we propose a stateful black-box encryption protocol fuzzing method to analyze the security of real-world black-box encryption protocol programs and devices. This method does not rely on the source code but uses captured packets as input, performs state selection based on a Monte Carlo tree search algorithm, and processes the encryption/decryption conversion of mutant test cases based on the intermediate mapper. It sends test cases and collects responses in interactive communication with the tested program and dynamically optimizes the corpus based on the collected state information. Based on this method, we develop SBEPFuzz and primarily analyze IPsec. We evaluate SBEPFuzz on six widely used IPsec implementations. The experimental results show that SBEPFuzz achieves higher code coverage, and can discover more protocol state sequences and vulnerabilities. Furthermore, we discover four anomalies, including malformed packets triggering service crashes and abnormal interactions leading to plaintext ID leakage, which also reflect the differences in details among different implementations.