A state protocol fuzzing method and process based on a hierarchical large language model framework

Abstract

This invention discloses a state protocol fuzzing method and process based on a hierarchical large language model framework, belonging to the field of cyberspace security technology. Addressing the problems of skill dilution, context obfuscation, and high computational cost inherent in existing single large language model-driven fuzzing methods, this invention constructs a syntax analysis layer, a semantic reasoning layer, and a policy optimization layer. Specifically, the syntax analysis layer extracts a structured syntax tree from the raw message using protocol templates and an LLM (Local Language Model); the semantic reasoning layer combines protocol state with the syntax tree to infer business logic constraints, identify vulnerability patterns, and dynamically assess risks; and the policy optimization layer intelligently generates and adaptively adjusts mutation strategies based on risk scores and historical feedback. This invention effectively improves the coverage depth of the protocol state space and the efficiency of vulnerability discovery, while reducing computational costs, providing an efficient, intelligent, and economical solution for the security testing of complex network protocols.

Description

Technical Field

[0001] This invention relates to the field of cyberspace security technology, specifically to a security testing method and system for network protocol implementation, which is a state protocol fuzzy testing method and process based on a hierarchical large language model framework. Background Technology

[0002] Fuzzing is a dynamic program analysis technique that discovers potential vulnerabilities by inputting anomalous data into a target program. It is widely used in the testing of network protocols, security software, and IoT devices. However, traditional fuzzing methods, especially for network protocol testing, face challenges such as low efficiency in state space exploration, lack of targeted mutation strategies, and insufficient understanding of protocol semantics. Current mainstream tools, such as the generation-based Peach and the mutation-based AFLNet, have achieved partial automation, but they have significant limitations: coverage guidance methods, represented by AFLNet, rely on byte-level random mutation and lack an understanding of high-level business logic, resulting in test cases that are often rejected by the server even if they are syntactically correct; at the same time, their mutation strategies are based on fixed rules and cannot be dynamically adjusted, making them prone to coverage stagnation when dealing with complex protocol state machines.

[0003] With the development of artificial intelligence technology, researchers are attempting to introduce large language models (MLMs) to improve the intelligence level of fuzz testing. The capabilities of large language models in code understanding and generation offer new ideas for tasks such as protocol syntax parsing and seed generation, and pioneering work such as ChatAFL has initially demonstrated its potential. However, existing LLM-driven methods still have fundamental architectural flaws. Therefore, how to utilize LLMs to achieve efficient, accurate, and cost-effective protocol fuzz testing—capable of deeply understanding protocol syntax and semantics while dynamically optimizing mutation strategies—remains a key problem that urgently needs to be solved. Summary of the Invention

[0004] The technical problem to be solved by this invention is to overcome the problems of skill dilution, context confusion and high computational overhead in existing protocol fuzzing testing methods driven by a single large language model, and to provide a hierarchical large language model framework that can decouple complex tasks, realize specialized division of labor and improve efficiency through intelligent caching mechanisms.

[0005] To address the aforementioned technical problems, this invention provides the following technical solution: a state protocol fuzzing method and process based on a hierarchical large language model framework, comprising the following steps: S1. At the L1 parsing layer, the original message sequence is received. And according to the target protocol type Select the appropriate protocol template Construct prompt words, and use a layer L1 proprietary large language model to fuse with an RFC standard knowledge base to process the original message sequence. Perform grammatical analysis and construct a structured syntax tree. The syntax tree is then validated and its confidence level is calculated, and the syntax tree is output. ; S2. In the semantic reasoning layer L2, combined with the current protocol state. The syntax tree output by step S1 It leverages a proprietary L2 language model to infer business logic constraints, handle state dependencies, identify vulnerability patterns, dynamically assess risks, and output context with risk assessment scores. ; S3. Risk score based on the output of step S2 and historical data The test scenarios are categorized, and the mutation operator weights are initialized. The initial mutation strategy is generated using a layer L3 proprietary large language model. It performs fuzz testing and implements a feedback self-correction loop: when the detected test index is lower than the preset threshold, it uses the layer L3 proprietary large language model to analyze the failure mode and generate a correction strategy to adjust the subsequent mutation strategy.

[0006] As a preferred embodiment of the present invention, step S1 includes the following steps: S11, Receive the original message sequence and target protocol type Calculate the message hash value And check if the L1 cache is hit. If the cache is hit, proceed directly to S18; if the cache is not hit, execute S12. S12, According to the target protocol type Select the corresponding analysis template And based on templates and original message sequences Constructing basic prompt words ; S13. Input the basic prompt words into the L1 proprietary large language model, integrate the RFC standard knowledge corresponding to the protocol, generate a preliminary grammatical structure, and obtain a syntax tree. ; S14, Execute the verification function Check the syntax tree Verify the correctness of the JSON format and the completeness of key fields. If verification fails, proceed to step S15; if verification succeeds, proceed to step S16. S15. Triggering a fallback mechanism: Utilizing the proprietary large language model of layer L1, using simplified prompt words. Generate a simplified syntax tree and label the confidence level as 1. ; S16. Hash the current message value With the corresponding syntax tree Store in L1 cache ; S17, If syntax tree The confidence level is lower than the minimum confidence threshold. If the connection with the semantic reasoning layer L2 and the policy optimization layer L3 is broken, the method reverts to the baseline fuzzy testing method based on random mutation; if the syntax tree The confidence level is higher than the minimum confidence threshold. Continue executing S18.

[0007] S18, Output syntax tree To the semantic reasoning layer L2.

[0008] As a preferred embodiment of the present invention, step S2 includes the following steps: S21, Receive the syntax structure tree from layer L1 Current protocol status and protocol type Calculate state key value And cached in layer L2 The search is performed within the cache; if a cached match is found, the cached semantic context is returned directly. ; S22. If the cache is not hit, construct semantic reasoning prompts. The requirement is for the large language model to analyze the business logic constraints and state dependencies in the current state; S23, The semantic reasoning prompt words The input layer uses a proprietary L2 large language model to generate basic semantic context. ; S24. Check if there is a state transition in the current protocol state; S25. If a state transition exists, construct vulnerability analysis hints. It then uses its input layer L2 proprietary large language model for inference to identify vulnerability patterns and calculate risk scores. Then, the identified vulnerability patterns are integrated into the current semantic context. ; S26. Form a complete semantic context containing vulnerability pattern information. And determine its risk score. Has the preset threshold been reached? S27. If the risk score reaches the threshold, then the complete semantic context of the current state will be... Store in L2 cache ; S28. The final semantic context Output to layer L3 for use by the strategy optimization layer.

[0009] As a preferred embodiment of the present invention, step S3 includes the following steps: S31, Receive semantic context from layer L2 Historical data and real-time feedback Calculate composite key values And cached in layer L3 The system performs a search and simultaneously checks if the cached item has expired. S32. If the cache is not hit or the cached item has expired, then based on the current semantic context... and historical data Map the fuzz testing scenario to the corresponding strategy pattern. ; The strategy pattern includes: L2 risk scoring at the current layer. Vulnerability focus mode triggered by time; coverage focus mode triggered when a new code block is discovered but not yet explored in depth; exploration focus mode triggered when the system enters a coverage plateau; depth focus mode for deep state chains; S33. Initialize the corresponding mutation operator weight vector according to the mapped policy pattern. ; S34. Constructing strategies to generate prompt words It requires large language models to be based on the current semantic context. Historical data and mutation operator weight vector Generate mutation strategy ; S35. Generate prompt words using the strategy. Input layer L3 proprietary large language model, generating initial mutation strategy ; S36. The fuzz testing execution engine uses the aforementioned mutation strategy to generate test cases and execute tests, collecting test data to generate new real-time feedback. ; S37. Calculate performance metrics using the new real-time feedback, including success rate. and coverage gain ; S38. If the success rate Less than or coverage gain Less than Then, failure features are extracted from the feedback to construct adaptively adjusted prompt words. The task is to analyze the reasons for the failure of the large language model and propose a correction scheme, then integrate the correction scheme with the current mutation strategy to generate an optimized mutation strategy. ; S39. Set the current key combination value With mutation strategy Add to L3 cache in key-value pair format Furthermore, a Time-to-Live (TTL) mechanism is used to manage cached items.

[0010] Compared with existing technologies, the state protocol fuzzy testing method and process based on a hierarchical large language model framework provided by this invention has the following beneficial effects: 1. This invention decouples complex protocol fuzzing tasks by constructing a three-layer cognitive architecture consisting of a syntax analysis layer, a semantic reasoning layer, and a policy optimization layer, overcoming the skill dilution, context confusion, and decision-making bottlenecks inherent in existing single-model-driven methods. Specifically, the syntax analysis layer focuses on the precise parsing of message structures, ensuring the syntactic validity of generated test cases; the semantic reasoning layer handles complex business logic and state dependencies, enabling test cases to delve into the protocol state machine; and the policy optimization layer dynamically adjusts mutation strategies based on historical feedback. Through this layered collaborative mechanism, this invention significantly enhances the ability to explore the protocol state space. Compared to existing fuzzing tools based on large language models and traditional coverage-guided fuzzing tools, this invention achieves significantly improved state coverage and code branch coverage, especially when dealing with complex state protocols such as DTLS, where the improvement in state path exploration capability is even more pronounced. Comparative tests showed that this invention achieved a state coverage of 538 state paths and a code branch coverage of 59.73 on the TinyDTLS protocol, representing improvements of 122.31% and 57.29% respectively compared to existing single large language model methods. This fully demonstrates the layered architecture's ability to deeply explore the state space and program logic paths of complex protocols. For specific experimental data and testing environment, please refer to the "Experimental Comparison and Effect Verification" section in the detailed implementation plan.

[0011] 2. This invention effectively reduces the computational overhead of a layered architecture by designing a protocol-aware, multi-level caching mechanism. To address the objective invariance of the syntax layer output and the timeliness requirements of the strategy layer output, static caching based on content hashing and dynamic caching based on time-to-live (TTL) strategies are designed respectively. This mechanism avoids frequent invalid calls to the large language model in repetitive scenarios, significantly reducing inference overhead. Experimental results show that this protocol-aware caching mechanism can significantly reduce overall token consumption. During the stable testing phase, token consumption remains at an extremely low level, demonstrating the cost-effectiveness and scalability of this invention in large-scale, long-term fuzzing tasks. Specifically, in a comparative test with existing single large language model methods, this invention reduces overall token consumption by approximately 47% through the protocol-aware, multi-level caching mechanism, significantly improving the economy of fuzzing and making it more suitable for large-scale, long-term deployment applications. Specific experimental data can be found in the "Experimental Comparison and Effect Verification" section of the detailed implementation.

[0012] 3. This invention achieves dynamic adjustment and self-correction of mutation strategies by introducing an adaptive strategy optimization mechanism based on real-time feedback. The strategy optimization layer intelligently classifies test scenarios into modes such as vulnerability focusing, coverage guidance, or deep exploration based on the risk score output by the semantic reasoning layer and historical data H, and assigns differentiated mutation operator weights to different modes. Furthermore, when coverage growth stagnates or the test case success rate falls below a threshold, this layer automatically triggers a self-correction loop, analyzing failure modes and invoking a large language model to generate correction strategies, thereby effectively overcoming coverage plateaus. This closed-loop feedback mechanism enables this invention to continuously learn from historical errors, dynamically adapt to the characteristics of the tested protocol, and achieve significant improvements in state coverage for complex protocols.

[0013] 4. This invention significantly enhances the ability to deeply discover vulnerabilities in specific protocols by constructing protocol-specific optimization strategies and risk quantification models. By configuring customized analysis templates, field extraction strategies, and vulnerability pattern recognition rules for various mainstream protocols, the syntax analysis layer and semantic reasoning layer can deeply understand the protocol's business logic and implementation constraints. In particular, the dynamic risk scoring model integrated into the semantic reasoning layer can identify high-risk states in real time based on context and guide the strategy optimization layer to conduct focused testing. In practical applications, this invention has successfully discovered multiple security vulnerabilities in widely used protocol implementations, covering several key areas such as the Internet of Things, network infrastructure, medical imaging, and industrial control systems, demonstrating its powerful cross-protocol vulnerability discovery capabilities.

[0014] 5. This invention introduces a confidence-based circuit breaker mechanism to enhance the robustness and reliability of the framework. By setting a minimum confidence threshold for the syntax analysis layer, when the parsing result quality is too low, the system automatically triggers the circuit breaker, bypassing the high-level semantic reasoning and policy optimization layers, and directly reverting to the baseline random mutation method. This design effectively prevents the "illusion" that may be generated by the large language model from propagating and amplifying between multiple layers, ensuring the stability of the testing process and the maintenance of basic testing capabilities in complex or unknown protocol scenarios. Attached Figure Description

[0015] Figure 1 This is a schematic diagram of the overall framework of an embodiment of the present invention; Figure 2 This is a schematic diagram of the workflow in this invention; Figure 3 This is a schematic diagram of the L1 syntax analysis layer in this invention; Figure 4 This is a schematic diagram of the workflow of the semantic reasoning layer L2 in this invention; Figure 5 This is a schematic diagram of the workflow of the strategy optimization layer L3 in this invention. Detailed Implementation

[0016] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention without creative effort are within the scope of protection of the present invention.

[0017] This embodiment uses TinyDTLS (an implementation of the DTLS protocol in an IoT environment) as the test target to illustrate the specific implementation process of the method of the present invention in detail.

[0018] Please see Figures 1-5 A state protocol fuzzing method and process based on a hierarchical large language model framework includes the following steps: S1. At the L1 parsing layer, the original message sequence is received. And according to the target protocol type (This example uses TinyDTLS) Select the appropriate protocol template. Construct prompt words, and use a layer L1 proprietary large language model to fuse with an RFC standard knowledge base to process the original message sequence. Perform grammatical analysis and construct a structured syntax tree. The syntax tree is then validated and its confidence level is calculated, and the syntax tree is output. ; S2. In the semantic reasoning layer L2, combined with the current protocol state. The syntax tree output by step S1 It leverages a proprietary L2 language model to infer business logic constraints, handle state dependencies, identify vulnerability patterns, dynamically assess risks, and output context with risk assessment scores. ; S3. Risk score based on the output of step S2 and historical data The test scenarios are categorized, and the mutation operator weights are initialized. The initial mutation strategy is generated using a layer L3 proprietary large language model. It performs fuzz testing and implements a feedback self-correction loop: when the detected test index is lower than the preset threshold, it uses the layer L3 proprietary large language model to analyze the failure mode and generate a correction strategy to adjust the subsequent mutation strategy.

[0019] S1 includes the following steps: S11, Receive the original message sequence and target protocol type Calculate the message hash value And check if the L1 cache is hit. If the cache is hit, proceed directly to S18; if the cache is not hit, execute S12. S12, According to the target protocol type Select the corresponding analysis template TinyDTLS is a binary or hybrid protocol; the system will select a template. This template guides LLM to focus on identifying TLV (Type-Length-Value) structures, determining byte order, and extracting key Magic Bytes. It is based on the template and the original message sequence. Constructing basic prompt words ; S13. Input the basic prompt words into the L1 proprietary large language model (in this embodiment, GPT-3.5-Turbo, with a temperature of 0.7 to balance semantic coherence and grammatical accuracy), fuse it with the RFC standard knowledge corresponding to the protocol, generate a preliminary grammatical structure, and obtain a syntax tree. ; in" The "" symbol represents the assignment / update function, indicating that the result of the calculation on the right is assigned to the variable on the left, and is used to describe the state update during the execution of the algorithm.

[0020] S14, Execute the verification function Check the syntax tree Verify the correctness of the JSON format and the completeness of key fields. If verification fails, proceed to step S15; if verification succeeds, proceed to step S16. S15. Triggering a fallback mechanism: Utilizing the proprietary large language model of layer L1, using simplified prompt words. Generate a simplified syntax tree The confidence level is marked as ; S16. Hash the current message value With the corresponding syntax tree Store in L1 cache ; S17, If syntax tree The confidence level is lower than the minimum confidence threshold. If the connection with the semantic reasoning layer L2 and the policy optimization layer L3 is broken, the method reverts to the baseline fuzzy testing method based on random mutation; if the syntax tree The confidence level is higher than the minimum confidence threshold. Continue executing S18.

[0021] S18, Output syntax tree To the semantic reasoning layer L2.

[0022] To improve system robustness, this invention incorporates a confidence-based circuit breaker mechanism at the syntax analysis layer L1 to prevent LLM parsing illusions from propagating to lower layers and ensuring stable operation of the testing process. When the complete syntax tree G_full fails verification by the validation function, or its confidence level falls below the preset minimum confidence threshold θ_min, the circuit breaker triggers a fallback: constructing simplified hint words. Call LLM to generate a simplified syntax tree. The confidence level is marked as Low; the message hash and simplified syntax tree are stored in the L1 cache; if the confidence level is still lower than the threshold, the connection with the L2 and L3 layers is disconnected, and the system is directly reverted to the traditional random mutation fuzz test to avoid error propagation.

[0023] S2 includes the following steps: S21, Receive the syntax structure tree from layer L1 Current protocol status (e.g., WAIT_CLIENTHELLO) and protocol type Calculate state key value And cached in layer L2 The search is performed within the cache; if a cached match is found, the cached semantic context is returned directly. ; S22. If the cache is not hit, use the function... Constructing semantic reasoning prompts The requirement is for the large language model to analyze the business logic constraints and state dependencies in the current state; For example, the UPLOAD command can only be sent after the AUTHENTICATE state returns 200 OK; in the WAIT_CLIENTHELLO state, the prompt word guides the LLM to understand that the server will only allocate session resources and transition to subsequent states after receiving a ClientHello message containing the correct cookie. This reasoning effectively guides the fuzz tester to avoid attempting to send encrypted data before cookie verification is complete, thus saving a large number of invalid test cases.

[0024] S23, The semantic reasoning prompt words The input layer uses a proprietary L2 large language model to generate basic semantic context. ; S24. Check if there is a state transition in the current protocol state; S25. If a state transition exists, then it is achieved through a function. Construct vulnerability analysis hints It then uses its input layer L2 proprietary large language model for inference, in order to pass through a function. Identify vulnerability patterns (For example, failure to verify cookies can lead to amplified DoS attacks) and through the function Calculate risk score Then, the identified vulnerability patterns are processed through a function. Integrate into the current semantic context ; S26. Form a complete semantic context containing vulnerability pattern information. And determine its risk score. Has the preset threshold been reached? Among them, Criticak Risk is a severe risk, indicating that there are a large number of high-risk vulnerability patterns, and the system is very likely to be exploited, leading to serious consequences such as crashes and data breaches; High Risk is a high risk, indicating that there are multiple high-risk vulnerability patterns, posing a significant security threat, and requiring key testing and verification; Medium Risk is a medium risk, indicating that there are a few vulnerability patterns, posing certain security risks, and requiring routine attention; Baseline is the baseline risk, indicating that no obvious vulnerability patterns have been identified, and only basic security baseline risks are retained.

[0025] Taking TinyDTLS as an example, Layer L2 performs real-time risk analysis, explicitly guiding the LLM to focus on high-risk patterns, such as computational resource exhaustion and state tampering, through prompts. If the LLM identifies that failure to verify cookies during the handshake process may lead to a potential denial-of-service amplification attack, it marks the state as a critical risk (0.9) and immediately triggers a high-priority cache update.

[0026] S27. If the risk score reaches the threshold, then the complete semantic context of the current state will be... Store in L2 cache ; S28. The final semantic context Output to layer L3 for use by the strategy optimization layer.

[0027] This invention constructs a protocol-specific risk quantification model based on the number of identified vulnerability patterns. Quantify security risks into calculable risk scores. The specific scoring rules are detailed in section S26 above. This model can dynamically adjust vulnerability identification rules and risk weights based on the characteristics of different protocols such as DTLS, SSH, DNS, and HTTP, achieving protocol-specific risk assessment.

[0028] S3 includes the following steps: S31, Receive semantic context from layer L2 Historical data and real-time feedback Calculate composite key values And cached in layer L3 The system performs a search and simultaneously checks if the cached item has expired. S32. If the cache is not hit or the cached item has expired, then based on the current semantic context... and historical data Through function Classify test scenarios and map fuzzy test scenarios to corresponding strategy patterns. ; The strategy pattern includes: L2 risk scoring at the current layer. Vulnerability focus mode triggered by time; coverage focus mode triggered when a new code block is discovered but not yet explored in depth; exploration focus mode triggered when the system enters a coverage plateau; depth focus mode for deep state chains; Vulnerability-focused mode refers to the current L2 risk score. The following modes are triggered: 1) High-risk vulnerability patterns are identified in the current state, or historical data shows that the state has abnormal records; 2) Coverage-focused mode is triggered when a new code block / new state path is discovered during testing and has not yet been fully explored, and the risk score is lower than the high-risk threshold; 3) Exploration-focused mode is triggered when the coverage gain is lower than the threshold for multiple consecutive rounds of testing and the coverage plateau is reached; 4) Depth-focused mode is triggered when the current state is in a deep state chain, depends on multiple state transitions, or belongs to a low-frequency, high-difficulty reachable state.

[0029] For example, when Layer 2 reports a potential buffer overflow risk in TinyDTLS's dtls_handle_message function, Layer 3 will automatically switch to vulnerability-focused mode. The cue words explicitly instruct targeting identified vulnerability patterns and exploiting protocol-specific weaknesses, significantly increasing the generation of targeted strategies.

[0030] S33. Based on the mapped strategy pattern, through the function Initialize the corresponding mutation operator weight vector ; S34. Constructing strategies to generate prompt words It requires large language models to be based on the current semantic context. Historical data and mutation operator weight vector Generate mutation strategy ; S35. Generate prompt words using the strategy. Input layer L3 proprietary large language model, generating initial mutation strategy (For example, for the dtls_handle_message function of TinyDTLS, it is recommended to perform operations such as boundary padding, field reversal, and type obfuscation.) S36. The fuzz testing execution engine uses the aforementioned mutation strategy to generate test cases and execute tests, collecting test data to generate new real-time feedback. ; S37. Calculate performance metrics using the new real-time feedback, including success rate. and coverage gain ; S38. If the success rate Less than or coverage gain Less than Then, failure features are extracted from the feedback to construct adaptively adjusted prompt words. The task is to analyze the reasons for the failure of the large language model and propose a correction scheme, then integrate the correction scheme with the current mutation strategy to generate an optimized mutation strategy. ; S39. Set the current key combination value With mutation strategy Add to L3 cache in key-value pair format Furthermore, a Time-to-Live (TTL) mechanism is used to manage cached items.

[0031] For example, due to coverage saturation, the mutation strategy for DTLS_STATE_CONNECTED may become invalid after 5 minutes, so a forced refresh and re-invocation of ConstructAdaptPrompt are required to explore new paths.

[0032] To verify the technical advantages of this invention compared to existing protocol fuzzing testing methods driven by a single large language model (represented by ChatAFL), this embodiment uses the TinyDTLS protocol as the test target and conducts a 24-hour comparative test under the same test environment. The test environment is consistent with the aforementioned implementation process. The experimental results are shown in the table below: The experimental data above demonstrates that this invention, through the specialized division of labor among the syntax analysis layer, semantic reasoning layer, and policy optimization layer, can achieve a deeper understanding of the state machine logic and business semantics of different protocol types. On the IoT security protocol TinyDTLS, this invention achieves 538 state paths, a 122.31% improvement over existing methods using a single large language model; on the security-critical protocol OpenSSH, it achieves 2055 state paths, a 91.16% improvement over existing methods; on the network infrastructure protocol dnsmasq, it achieves 1139 state paths, a 153.11% improvement over existing methods; and on the web server protocol lighttpd, it achieves 1103 state paths, a 90.83% improvement over existing methods. Even on the algorithm-intensive protocol OpenSSL, the state coverage of this invention is essentially on par with existing methods, without any performance degradation. These experimental data fully verify the broad applicability and stable performance of this invention across different protocol types and provide empirical support for the state space exploration capabilities mentioned in the beneficial effects section.

[0033] Although embodiments of the invention have been shown and described, it will be understood by those skilled in the art that various changes, modifications, substitutions and alterations can be made to these embodiments without departing from the principles and spirit of the invention, the scope of which is defined by the appended claims and their equivalents.

Claims

1. A fuzzy testing method and process for state protocols based on a hierarchical large language model framework, characterized in that, Includes the following steps: S1. In the parsing layer L1, the original message sequence is received. And according to the target protocol type Select the appropriate protocol template Construct prompt words and integrate them with RFC (Request for Comments) standard knowledge base documents to process the original message sequence. Perform grammatical analysis and construct a structured syntax tree. The syntax tree is then validated and its confidence level is calculated. S2. In the semantic reasoning layer L2, combined with the current protocol state. The syntax tree output by step S1 It utilizes a proprietary L2 language model to infer protocol functional logic constraints, handle state dependencies, identify vulnerability patterns, dynamically assess risks, and output risk assessment scores. Context ; S3. Risk score based on the output of step S2 and historical data The test scenarios are categorized, and the mutation operator weights are initialized. The initial mutation strategy is generated using a layer L3 proprietary large language model. It performs fuzz testing and implements a feedback self-correction loop: when the detected test index is lower than the preset threshold, it uses the layer L3 proprietary large language model to analyze the failure mode and generate a correction strategy to adjust the subsequent mutation strategy.

2. The method according to claim 1, characterized in that, Step S1 includes the following operations of the parsing layer L1: S11, Receive the original message sequence and target protocol type Calculate the message hash value And check if the L1 cache is hit. If the cache is hit, proceed directly to S18; if the cache is not hit, execute S12. S12, According to the target protocol type Select the corresponding analysis template And based on templates and original message sequences Constructing basic prompt words ; ; ; S13. Input the basic prompt words into the L1 proprietary large language model, integrate the RFC standard knowledge corresponding to the protocol, generate a preliminary grammatical structure, and obtain a syntax tree. ; ; ; S14, Execute the verification function Check the syntax tree Verify the correctness of the JSON format and the completeness of key fields. If verification fails, proceed to step S15; if verification succeeds, proceed to step S16. S15. Triggering a fallback mechanism: Utilizing the proprietary large language model of layer L1, using simplified prompt words. Generate a simplified syntax tree and label the confidence level as 1. ; ; ; ; S16. Hash the current message value With the corresponding syntax tree Store in L1 cache ; ; S17, If syntax tree The confidence level is lower than the minimum confidence threshold. If the connection with the semantic reasoning layer L2 and the policy optimization layer L3 is broken, the method reverts to the baseline fuzzy testing method based on random mutation; if the syntax tree The confidence level is higher than the minimum confidence threshold. Continue executing S18; S18, Output syntax tree To the semantic reasoning layer L2.

3. The method according to claim 1, characterized in that, Step S2 includes the following operations of the semantic reasoning layer L2: S21, Receive the syntax structure tree from layer L1 Current protocol status and protocol type Calculate state key value And cached in layer L2 The search is performed within the cache; if a cached match is found, the cached semantic context is returned directly. ; S22. If the cache is not hit, construct semantic reasoning prompts. The requirement is for the large language model to analyze the business logic constraints and state dependencies in the current state; ; S23, The semantic reasoning prompt words The input layer uses a proprietary L2 large language model to generate basic semantic context. ; ; S24. Check if there is a state transition in the current protocol state; S25. If a state transition exists, construct vulnerability analysis hints. It then uses its input layer L2 proprietary large language model for inference to identify vulnerability patterns and calculate risk scores. Then, the identified vulnerability patterns Integrate into the current semantic context ; ; ; ; ; S26. Form a complete semantic context containing vulnerability pattern information. And determine its risk score. Has the preset threshold been reached? ; S27, if risk score If the threshold is reached, the complete semantic context of the current state will be... Store in L2 cache ; S28. The final semantic context Output to layer L3 for use by the strategy optimization layer.

4. The method according to claim 1, characterized in that, Step S3 includes the following operations of the policy optimization layer L3: S31, Receive semantic context from layer L2 Historical data and real-time feedback Calculate composite key values And cached in layer L3 The system performs a search and simultaneously checks if the cached item has expired. S32. If the cache is not hit or the cached item has expired, then based on the current semantic context... and historical data Map the fuzz testing scenario to the corresponding strategy pattern. ; ; The strategy patterns include: L2 risk score The vulnerability focus mode is triggered at any time; Coverage focus mode is triggered when a new code block is discovered but not yet explored in depth; The exploration-focused mode is triggered when the system enters a coverage plateau. A deep focus mode for deep state chains; S33. Initialize the corresponding mutation operator weight vector according to the mapped policy pattern. ; ; ; S34. Constructing strategies to generate prompt words It requires large language models to be based on the current semantic context. Historical data and mutation operator weight vector Generate mutation strategy ; ; S35. Generate prompt words using the strategy. Input layer L3 proprietary large language model, generating initial mutation strategy ; ; S36. The fuzz testing execution engine uses the aforementioned mutation strategy to generate test cases and execute tests, collecting test data to generate new real-time feedback. ; S37. Calculate performance metrics using the new real-time feedback, including success rate. and coverage gain ; ; S38. If the success rate Less than or coverage gain Less than Then, failure features are extracted from the feedback to construct adaptively adjusted prompt words. The task is to analyze the reasons for the failure of the large language model and propose a correction scheme, then integrate the correction scheme with the current mutation strategy to generate an optimized mutation strategy. ; ; ; S39. Set the current key combination value With mutation strategy Add to L3 cache in key-value pair format Furthermore, a Time-to-Live (TTL) mechanism is used to manage cached items.

Images