Internet of Things HTTP fuzzy testing method based on large language model

Abstract

The invention discloses an Internet of Things HTTP fuzzing method based on a large language model, and relates to the technical field of Internet of Things HTTP fuzzing. The method comprises the following steps: data acquisition: adopting a data acquisition strategy to obtain data for the HTTP fuzzy test of the Internet of Things; data preprocessing: preprocessing the collected data, and providing high-quality input data for subsequent fuzzy testing; hTTP structure sensing guided by LLM: using a prompt adjustment method to label fuzzy variables in request data by using the LLM, understanding a protocol data structure, and guiding a variation process; lLM-guided seed template expansion: expanding a seed bank by enriching data packets and expanding field values; lLM-guided seed variation and seed scheduling: optimizing test results by intelligently selecting and managing input seeds. According to the method, the efficiency and accuracy of fuzzy testing can be improved, and the vulnerability detection capability is enhanced.

Description

Technical Field

[0001] The present invention relates to the technical field of HTTP fuzz testing for the Internet of Things, and in particular to an HTTP fuzz testing method for the Internet of Things based on a large language model. Background Art

[0002] The Internet of Things (IoT) technology is developing rapidly, significantly changing people's living and working environment. By 2024, the number of connected IoT devices worldwide has reached 17.02 billion, and is expected to reach approximately 30 billion by 2030. This rapid growth has brought important security challenges. Although IoT devices provide convenience through web interfaces, they also introduce many security risks. Many devices have design flaws and hidden serious vulnerabilities that may lead to attacks such as unauthorized access, data theft, or remote code execution. Fuzz testing, as an effective vulnerability detection technology, plays a key role in the security testing of IoT devices. However, due to the complexity of the HTTP protocol and the unique characteristics of IoT devices, existing fuzz testing tools face limitations in practical applications, especially inefficiency in processing HTTP protocol packets.

[0003] HTTP protocol fuzz testing is a technique for discovering vulnerabilities and security issues by sending large amounts of random or malformed data to a target application. When performing HTTP protocol fuzz testing, fuzz testing tools must strictly adhere to protocol specifications when generating test data. Mutations to fixed fields of the protocol may result in many invalid data packets that cannot be parsed, reducing the efficiency of fuzz testing. In addition, if the number of initial seeds is insufficient or does not match the expected fields of the target code, it will be difficult to test more functions and code branches in the service. Many testing tools rely on manually created seed templates, which reduces the degree of automation and makes it difficult to cope with complex protocols. In addition, although some advanced tools attempt to guide fuzz testing with limited feedback, they are still insufficient in obtaining and optimizing initial seeds. Summary of the invention

[0004] The technical problem to be solved by the present invention is how to provide an Internet of Things HTTP fuzzy testing method based on a large language model that can improve the efficiency and accuracy of fuzzy testing and enhance vulnerability detection capabilities.

[0005] In order to solve the above technical problems, the technical solution adopted by the present invention is: an Internet of Things HTTP fuzzy testing method based on a large language model, comprising the following steps: Data collection: Adopt data collection strategies to obtain data for IoT HTTP fuzz testing; Data preprocessing: preprocess the collected data to provide high-quality input data for subsequent fuzz testing; HTTP protocol structure perception: The HTTP service interface information of the IoT device is input, and the prompt adjustment method is used to use the large language model LLM to annotate the fuzzy variables in the request data, understand the protocol data structure, and guide the mutation process; at the same time, the data packet information parsed by the LLM is used to generate seed templates. The seed templates retain the structure of the HTTP protocol and extract all variable parameter values. These templates record information related to seed mutation, thereby more effectively guiding the seed scheduling and mutation process; Seed template extension: Expand the seed template library by enriching data packets and extending field values. Use static analysis and prompts to analyze key code segments and partial request content to generate additional valid seed templates and field values. LLM-guided seed mutation: Seed templates are integrated in the initial design phase, which identify and mark the variable parts in HTTP packets; ChatHTTPFuzz first determines the type of the marked content, then applies targeted mutations to different fields, and combines the field values ​​extracted from the backend code to perform further mutations using the large language model LLM. The marked fields undergo additional mutations by the Radamsa tool to introduce greater randomness and unpredictability, further enriching the generated seed data; Seed scheduling: Optimize test results by intelligently selecting and managing input seeds. After generating a large number of seed templates, these seed templates are scheduled to balance the exploration and utilization stages to ensure that the seeds can trigger new code branches and make untested seeds more likely to be selected. Among them, exploration is to test seed templates that have not been fully evaluated to obtain more information and discover potential effective templates, and utilization is to select the best performing seed template based on existing data to maximize immediate benefits.

[0006] The beneficial effects of adopting the above technical solution are: 1) Improving the efficiency and accuracy of fuzz testing: In the method, ChatHTTPFuzz uses the powerful parsing ability of LLM to automatically identify valid mutation points in HTTP protocol data, which can reduce manual intervention and significantly improve the accuracy and efficiency of testing.

[0007] 2) Optimize initial seed generation: In this application, ChatHTTPFuzz uses LLM to analyze service code and protocol generation capabilities to generate new data packets consistent with code logic, thereby enriching seed templates and their field values. This approach not only improves the number of seeds, but also improves the quality of seeds, ensuring more comprehensive coverage of complex scenarios in IoT HTTP services.

[0008] 3) Enhanced vulnerability detection capabilities: In this application, ChatHTTPFuzz aims to identify and discover more potential security vulnerabilities by conducting in-depth and comprehensive fuzz testing on HTTP services of Internet of Things (IoT) devices. The design and implementation of the system is based on the Large Language Model (LLM), which enables it to parse the HTTP protocol and analyze service code more effectively, thereby improving the depth and breadth of vulnerability detection. ChatHTTPFuzz's vulnerability detection capabilities have been significantly improved, and it can handle complex HTTP protocol structures, generate standard-compliant test cases, and effectively cover more test scenarios. It not only improves the security assessment capabilities of IoT devices, but also provides a solid foundation for the development of safer IoT products, helping enterprises and developers better identify and fix security vulnerabilities during device design and deployment, thereby reducing potential security risks.

[0009] 4) Overcoming the limitations of existing tools: In this application, ChatHTTPFuzz overcomes the limitations of traditional methods in protocol structure analysis by introducing LLM-guided protocol field annotation (LVA) technology. In addition, the LLM-guided seed template enrichment algorithm (LSTE) and the reinforcement learning-based dual-factor gain seed template scheduling algorithm (STSA) further improve the coverage and detection efficiency of fuzz testing.

[0010] 5) Implementing an efficient seed scheduling mechanism: By designing an enhanced Thompson sampling algorithm, ChatHTTPFuzz can intelligently schedule seed templates based on their historical performance and potential mutation capabilities. This scheduling mechanism effectively balances exploration and exploitation, ensuring maximum efficiency in information acquisition and vulnerability discovery during fuzz testing. BRIEF DESCRIPTION OF THE DRAWINGS

[0011] The present invention will be further described in detail below in conjunction with the accompanying drawings and specific embodiments.

[0012] Figure 1 is an overall flow chart of the method described in the embodiment of the present invention; Figure 2 It is a schematic diagram of HTTP protocol structure perception and seed template expansion in the method described in an embodiment of the present invention; Figure 3 is a schematic diagram of seed variation in the method described in the embodiment of the present invention; Figure 4 It is a schematic diagram of seed scheduling in the method described in an embodiment of the present invention. DETAILED DESCRIPTION

[0013] The following is a clear and complete description of the technical solutions in the embodiments of the present invention in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0014] In the following description, many specific details are set forth to facilitate a full understanding of the present invention, but the present invention may also be implemented in other ways different from those described herein, and those skilled in the art may make similar generalizations without violating the connotation of the present invention. Therefore, the present invention is not limited to the specific embodiments disclosed below.

[0015] Overall, such as Figure 1 As shown, the embodiment of the present invention discloses an Internet of Things HTTP fuzzy testing method based on a large language model, comprising the following steps: Data collection; Data preprocessing; LLM-guided HTTP protocol structure awareness; LLM-guided seed template expansion; LLM-guided seed mutation; Seed scheduling.

[0016] The following is a detailed description of the above steps combined with specific methods 1. Data Collection: This paper aims to adopt an efficient data collection strategy for HTTP fuzz testing of the Internet of Things, ensure the acquisition of high-quality data, and provide rich and high-quality data support for HTTP fuzz testing of the Internet of Things, thereby improving the efficiency and accuracy of vulnerability detection. The data collection sources are as follows: 1) HTTP protocol data collection: Collect HTTP request and response examples related to IoT devices, including various request methods (such as GET, POST, PUT, DELETE) and their corresponding fields; extract protocol specification information from existing protocol documents (such as RFC) to ensure that the generated test cases comply with the standards.

[0017] 2) Service code collection: Obtain the backend code of the IoT device, which may include API implementation, business logic processing, and related configuration files; use static analysis tools to extract functions, variables, and control flow information in the code to identify key logic paths and potential test points.

[0018] 3) Initial seed template acquisition: Collect existing test cases and seed templates, which can be manually created or extracted from other fuzz testing tools; analyze past test records to determine valid seed data formats and fields.

[0019] 4) Runtime feedback information collection: During the fuzz testing process, the server’s response, error information, timeouts, and other feedback are recorded in real time; code coverage is monitored to evaluate the actual impact of the test cases on the code.

[0020] 2. Data Preprocessing The data preprocessing process includes the following main steps: 1) Data cleaning: In the first step of data preprocessing, the collected HTTP request and response data are cleaned to remove invalid, duplicate or malformed samples. This process includes verifying the structure and content of each data sample to ensure that all data complies with HTTP protocol specifications, such as the correct format of the request method, request header and response header, and valid status code. Through screening and consistency checking, samples with missing required fields or mismatches are deleted, and finally high-quality data sets are retained, thus providing a reliable foundation for subsequent fuzz testing.

[0021] 2) Data labeling: In this stage, by using a large language model to label HTTP protocol data, key fields and variables can be effectively identified. This process not only provides the necessary information for the subsequent generation of test cases, but also ensures the consistency of the generated test data with the protocol structure. In addition, adding comments to the service code to detail the logic path and the functions of the variables helps to deeply understand the code logic. These comments provide guidance for the generation of fuzz testing, making the test cases more accurate and relevant, thereby improving the overall test effect.

[0022] 3) Data conversion: During the data conversion phase, complex HTTP requests and responses need to be converted into a machine-readable format to ensure that they can be effectively processed by fuzz testing tools. This includes converting unstructured text data into a structured data model to make it easier to parse and analyze. At the same time, in order to adapt to the processing requirements of the large language model (LLM), the data format must also be optimized for easy input and processing. This conversion not only improves the availability of data, but also improves the efficiency of fuzz testing, ensuring that the generated test cases can accurately reflect the structure and logic of the HTTP protocol.

[0023] 4) Seed template expansion: In this phase, by generating mutation data based on the initial seed template, the breadth and depth of the test can be effectively enhanced. LLM is used to guide the generation of new seeds to ensure that these mutation data still meet the requirements of the HTTP protocol. In addition, by deeply analyzing the backend code, key logic and paths are identified to further enrich the diversity of seed templates. This approach ensures that the generated test cases can cover more code paths and scenarios, thereby improving the comprehensiveness and effectiveness of fuzz testing and helping to discover potential security vulnerabilities.

[0024] 5) Feature extraction: In the feature extraction phase, it is crucial to extract key features from HTTP protocol data and service code. These features include field type, data format, and expected value range, which can provide valuable guidance for test data generation strategies. By deeply analyzing these features, different types of data requirements and potential test scenarios can be identified, thereby optimizing the generated test data to ensure that it is more targeted and effective. This process enhances the understanding of complex systems and helps discover potential security vulnerabilities.

[0025] Through the above preprocessing steps, high-quality input data can be provided for subsequent fuzz testing, thereby improving the accuracy and efficiency of vulnerability detection.

[0026] 3. LLM-guided HTTP protocol structure perception The HTTP service interface information of IoT devices is input, and the prompt adjustment method is used to utilize LLM to annotate the fuzzy variables in the request data and understand the protocol data structure, thereby guiding the mutation process more effectively.

[0027] 1) LLM-guided HTTP protocol variable annotation The complete HTTP protocol mainly consists of a request header and a request body. Although the structure of the request header is relatively simple, the various fields it includes make it challenging to accurately identify and process. The request body usually includes complex data structures and data in custom formats, which increases the difficulty of parsing.

[0028] In order to improve the accuracy of variable identification in the protocol using LLM, the following strategies are adopted: 1-1) Temperature Setting: Set the "Temperature" parameter of the LLM to 0 to ensure accurate extraction of information from the event. Lower temperatures can generate more precise and stable results.

[0029] 1-2) Partial processing: The HTTP data packet is divided into the request header and the request body, and different prompts are designed according to the characteristics of each part to help LLM understand its grammatical structure and generate the required output.

[0030] 1-3) Example learning: Using a small number of example learning methods, multiple question-answering examples are used to clarify the task requirements. These examples help identify fields suitable for annotation and define the basic components that must remain unchanged in the protocol and data structure.

[0031] 1-4) Variable marking: In the prompts and examples, use the $##$ symbol to mark variable elements as the data source for generating seed templates.

[0032] Through the above method, the ability and accuracy of LLM in variable recognition in HTTP protocol are enhanced.

[0033] 2) Seed template structure Generate seed templates using packet information parsed by LLM. Seed templates retain the structure of the HTTP protocol while extracting all variable parameter values. These templates record information related to seed mutation, thereby guiding the seed scheduling and mutation process more effectively. The structure mainly stores the following information: 2-1) Header and content annotation: Identify and annotate variables in the header and content data, and use the symbol $##$ to separate the annotated data from the original HTTP data. This annotation method records the exact location of the variable in the template, ensuring accurate replacement during the mutation process.

[0034] 2-2) Field collection: In order to facilitate more targeted operations during the mutation process, the field collection centrally manages all variable parameters and specifies the type of each field, such as integer (int), string (str), and special character encoding types (such as Base32, Base64, URL encoding).

[0035] 2-3) Mutation Space: In order to fully utilize the code analysis capabilities of LLM in fuzz testing, a mutation space is introduced for each identified field to store the potential value assignments inferred by LLM.

[0036] 2-4) Mutation scoring: Record the seed scores for each round and calculate the scores regularly, giving priority to seeds that trigger more code branches and obtain higher scores.

[0037] 2-5) Call count: Track the call count of each seed template to ensure that templates with fewer calls get more testing opportunities.

[0038] 4. LLM-guided seed template expansion The seed template library is expanded through two main methods: enriching data packets and extending field values. Using static analysis and carefully designed hints, key code segments and partial request content are analyzed to generate additional valid seed templates and field values.

[0039] 1) Static analysis preprocessing Before running ChatHTTPFuzz, you can perform static analysis preprocessing and asynchronous code analysis based on seed information. Specifically, the analysis of the correspondence between routing code and backend code can be divided into two modes: The first pattern is table-based routing. This approach uses a centralized routing table or configuration file to manage all routing information. Each URL path is explicitly mapped to a specific handler function or controller.

[0040] The second mode is file-based routing. In this approach, the structure of the file system usually determines the URL routing. Each URL path corresponds to a specific file, usually a CGI script or other executable file.

[0041] After the routing method is determined, IDA Python is used to extract the processing functions related to the routing information. The decompiled code is then saved in the folder configured by ChatHTTPFuzz in the specified format, thus completing the static analysis preprocessing.

[0042] 2) LLM-guided packet generation The initial method of capturing traffic involves intercepting packets through live page access. While this approach ensures the acquisition of live traffic, due to the complexity of the backend architecture, some packets related to specific backend services may not be directly accessible through the frontend. To address these situations, the routing information and code extracted above are used to generate new request packets through LLM, and protocol-aware technology is used to parse the protocol to facilitate the creation of new seed templates.

[0043] To fully cover various execution paths, the hint sequence provides precise instructions, enabling LLM to generate multiple packets consistent with the code logic. This approach ensures that the generated packets correspond to the diverse logical branches of the system, providing extensive support for further testing and analysis.

[0044] 3) LLM-guided field expansion For routes including request packets, LLM is used to ensure the diversity and accuracy of field values. This approach is able to generate an additional set of fields consistent with the code logic, called the mutation space, which is designed to evaluate the potential of future seed mutations. Field expansion is achieved through the following two methods: The first approach is to identify the set of assignable values ​​for a variable. For IoT devices, a backend code block calls the GetVar function to retrieve POST parameters from the HTTP packet, which are compared via strcmp (or similar functions) and the code branches based on the results. Such comparison functions define the valid range or acceptable values ​​for the parameters. By analyzing the code logic, LLM is able to identify these functions and extract the corresponding set of valid strings. This process clarifies the possible parameter values ​​and generates logical packets to ensure that the test data triggers the expected execution path.

[0045] The second approach focuses on identifying specific format requirements. LLM can be used to identify and extend the format requirements of fields in request packets. In addition to ensuring that fields are assigned valid values, certain parameters must follow strict format standards when generating packets. This format recognition and automatic generation capability enables ChatHTTPFuzz to create field values ​​that are difficult for other advanced tools to construct, thus providing the potential for discovering zero-day vulnerabilities.

[0046] ChatHTTPFuzz utilizes the seed template structure to store the extended field set obtained by the above method, thus providing richer and more precise choices for seed mutation.

[0047] like Figure 2 Shown is a schematic diagram of HTTP protocol structure perception and seed template expansion in this application.

[0048] 5. LLM-guided seed mutation Mutating arbitrary parts of the HTTP protocol often generates a large number of malformed packets. To improve mutation efficiency, seed templates were integrated during the initial design phase. The seed templates identify and mark the variable parts in HTTP packets. ChatHTTPFuzz first determines the type of the marked content and then applies targeted mutations to different fields. In addition, it combines field values ​​extracted from the backend code and uses LLM for further mutation. The marked fields undergo additional mutations by the Radamsa tool to introduce greater randomness and unpredictability, further enriching the generated seed data.

[0049] 1) Type-based variation For fields with numeric data types, mutation operations modify values ​​to boundary or extreme cases (for example, 0, -1, or extremely large numbers) to evaluate the behavior of the system under extreme conditions.

[0050] For fields that use special encoding formats (such as Base32, Base64, or URL encoding), a process of decoding, mutating, and then re-encoding is used to ensure that the integrity and accuracy of the data are maintained during the test regardless of the encoding format.

[0051] 2) Intelligent variation based on contextual content ChatHTTPFuzz uses LLM in combination with seed template structure to intelligently mutate field values, achieve more accurate testing and improve code coverage. In this process, LLM first analyzes the backend code related to HTTP packets to extract the actual usage and value set of the fields. Subsequently, ChatHTTPFuzz performs targeted mutations based on the VariationSpace variable that includes possible backend field values.

[0052] 3) Other variations 3-1) Processing of special characters: During the test, special characters in common encoding formats (such as ASCII, Unicode, UTF-8, GBK) will be replaced, and null bytes (\0), line breaks, etc. will also be processed. , carriage return (\r), and tab (\t). These special characters can cause unexpected behavior in the parser, potentially exposing hidden vulnerabilities.

[0053] 3-2) Mutation dictionary: To improve testing efficiency, a mutation dictionary can be built in advance. This dictionary includes known attack payloads that can be randomly selected during mutation testing. For example, it can include payloads for command injection, buffer overflow, and integer overflow targeting specific vulnerabilities.

[0054] 3-3) Program mutation based on Radamsa: Radamsa is a powerful fuzz testing tool that can mutate input data in a variety of ways to generate test cases. These test cases cover a wide range of boundary conditions and abnormal inputs.

[0055] like Figure 3 Shown is a schematic diagram of the seed mutation process in this application.

[0056] 6. Seed Scheduling Seed scheduling is a key technology in fuzz testing, which aims to optimize test results by intelligently selecting and managing input seeds, thereby improving efficiency and code coverage. After generating a large number of seed templates, it is crucial to effectively schedule these seeds to balance "exploration" and "exploitation". This balance ensures that seeds can trigger new code branches and makes untested seeds more likely to be selected.

[0057] “Exploration” refers to testing seed templates that have not been fully evaluated to obtain more information and discover potential effective templates, while “Exploitation” focuses on selecting the best performing seed templates based on existing data to maximize immediate benefits.

[0058] In the structural relationship of seed templates, the seed template library is at the top. During each use, the system uses the template scheduling algorithm to select the template to be mutated from the library. The mutation process is based on the field type and its corresponding mutation space. The newly generated response template is stored back to the seed template library. As the number of templates in the library increases, a seed scheduling algorithm for the seed template structure is developed to improve the efficiency and logic of template selection and ensure optimal utilization as the library grows.

[0059] Three categories of seed templates with special value are prioritized to maximize their impact and ensure logical consistency in the scheduling process and optimization of system performance: 1) Historically successful mutation templates: These templates have previously generated valid test cases, successfully triggered new program behaviors or discovered potential vulnerabilities. Giving priority to these templates can significantly improve testing efficiency and increase vulnerability detection rates.

[0060] 2) Low-frequency templates: This category includes templates that were ignored for various reasons in multiple selections, as well as templates that were newly added to the template pool. Paying attention to these templates helps maintain diversity and comprehensiveness in the test.

[0061] 3) Rich mutation space templates: These templates include multiple variable fields or complex structures, providing a wider range of exploration possibilities. Giving priority to such templates can expand the coverage and depth of testing.

[0062] For the first type of templates (historically successful mutation templates), a seed selection algorithm based on Thompson sampling is used. This method updates the Bayesian posterior probability based on historical performance, balancing the relationship between exploring new templates and exploiting previously successful templates. For the second type of templates (low-frequency call templates), an exploration balance factor is used to ensure that the system does not ignore templates with low call frequencies, especially newly added templates. For the third type of templates (rich mutation space templates), a mutation potential factor is introduced to predict the future performance potential of the template, thereby enhancing the testing innovation ability and the ability to discover complex vulnerabilities.

[0063] 1) Seed selection algorithm based on Thompson sampling In order to effectively utilize historical data, the Thompson sampling method is adopted. This method dynamically updates the Bayesian posterior distribution to balance the trade-off between exploration and utilization, thereby improving the efficiency and accuracy of decision-making.

[0064] Assume that the prior distribution of N seed templates is expressed as In round k, the fuzz tester collects feedback information, expressed as ,in Indicates the number of attempts with a reward of 0. represents the number of attempts with a reward of 1 (a reward means successfully triggering a new branch or discovering a vulnerability). Based on the performance of each template in the first k rounds, the posterior distribution is updated to , in order to predict Performance at round k+1.

[0065] 2) Explore the balance factor Maintaining a balance between exploration and exploitation in the seed template selection process is crucial to ensure the effectiveness of fuzz testing. To this end, a novel exploration balance factor (EBF) is proposed to optimize the template selection strategy. The core concept of this factor is to prioritize templates with low call frequency while preventing the testing process from being completely dominated by rarely used templates.

[0066] The EBF is defined as follows:

[0067] in, Indicates the total number of calls of all templates, N is the total number of templates, and Respectively represent templates The design includes several key considerations: First, by dividing the number of template calls by Putting in the denominator, we establish The inverse relationship between the number of calls and the number of calls is used to give priority to templates with lower frequency of use. Secondly, the logarithmic function is used to effectively smooth extreme values ​​to prevent templates with very few calls from dominating the selection process. Finally, the The term allows this factor to be dynamically adjusted during the test process. By introducing this factor, templates with fewer calls are assigned a higher probability of selection, thereby promoting the exploration of under-tested areas.

[0068] 3) Mutation potential factor The mutation potential factor is a key indicator in the algorithm, which is used to evaluate the potential variability of the seed template. This factor measures the potential mutation space of the template by comparing the logarithmic ratio of the possible value set of each field of the current template with the maximum value set of all templates. Its calculation formula is as follows:

[0069] The numerator represents the mutation potential of the current template, while the denominator represents the maximum potential among all templates. Indicates the current template The size of the mutable field collection, and Represents the sum of mutable fields collections for all templates.

[0070] Using a logarithmic ratio prevents templates that include many fields from overly dominating the selection process (for example, one template might have hundreds of possible values ​​while another has only a few). Indicates the potential value that the template may generate in future tests. The value indicates that although the reward of the current template may not be the highest, it still has considerable room for improvement and potential value compared to other templates. Especially in the long-term fuzz testing process, the mutation potential factor can help the algorithm avoid falling into the local optimal solution and continue to explore templates that may lead to breakthrough discoveries.

[0071] 4) Integration In this application, a novel two-factor gain-enhanced Thompson sampling method is proposed to optimize the seed template selection and scheduling process. and explore the balance factor ,This method enhances the use of heuristic information while retaining the ,inherent advantages of traditional Thompson sampling, resulting in a more efficient and ,balanced template selection strategy.

[0072] The core innovation lies in the design of the dynamic gain mechanism, which and Adjusting and amplifying traditional Thompson sampling results , thereby expanding the dimensions of consideration in the decision-making process. Specifically, Evaluating the potential variation ability of the template enables the algorithm to proactively consider the potential value of certain templates in future iterations. Based on the historical usage of the template, it ensures that exploration and exploitation are effectively balanced in the decision-making process. The combination of the two factors allows the decision-making process to take into account historical performance (given by represents) and takes into account future potential and overall balance.

[0073] The specific integration method is as follows:

[0074] When designing the gain mechanism, we chose to combine these factors multiplicatively rather than additively. This choice creates a nonlinear gain mechanism that more accurately captures the complex interactions between the factors, especially in extreme cases. For example, when or At higher values ​​of The influence of , increases the selection probability of some templates. On the contrary, when these factors are close to zero, their impact on the original Thompson sampling results is negligible, thus ensuring the basic stability of the algorithm.

[0075] like Figure 4 The figure shows a schematic diagram of seed scheduling in this application. Through the above steps, a mutated HTTP request, a vulnerability report and detailed information are finally generated.

[0076] The method described in the present invention aims to solve the fuzz testing challenges in the Internet of Things (IoT) environment and make full use of the protocol parsing and generation capabilities of LLM. ChatHTTPFuzz improves the accuracy and efficiency of testing by effectively solving key problems such as field identification and seed generation.

[0077] The present invention has the following advantages: 1) Automated protocol field parsing: LLM’s outstanding ability in parsing HTTP protocol fields achieves a 0% error rate and only a 4.74% false negative rate. This automated parsing capability enables LLM to implement protocol-aware field annotation and backend code analysis without manual intervention.

[0078] 2) Seed template generation and mutation guidance: Based on the code analysis and protocol generation capabilities of LLM, data packets consistent with the code logic are generated. This method not only increases the number of seed templates, but also improves their quality, making fuzz testing more effective.

[0079] 3) Enhanced Thompson Sampling Algorithm: An innovative two-factor gain-enhanced Thompson sampling algorithm is designed, which combines the exploration balance factor and the mutation potential factor to efficiently schedule seed templates. The algorithm uses the information of the seed template to optimize the template selection process, ensuring an effective balance between exploring new templates and utilizing existing successful templates.

[0080] 4) Protocol data awareness method: An LLM-based HTTP protocol data awareness method is proposed to automatically annotate protocol variable data, generate seed templates, and guide seed mutation. At the same time, an algorithm for enriching the seed template library is introduced to improve the quality and quantity of seeds.

Claims

1. A method for HTTP fuzz testing of the Internet of Things based on a large language model, characterized in that The steps include: Data collection: Adopt data collection strategies to obtain data for IoT HTTP fuzz testing; Data preprocessing: preprocess the collected data to provide high-quality input data for subsequent fuzz testing; HTTP protocol structure perception: Input the HTTP service interface information of the IoT device, use the prompt adjustment method to use the large language model LLM to annotate the fuzzy variables in the request data, understand the protocol data structure, and guide the mutation process; At the same time, the packet information parsed by LLM is used to generate seed templates. The seed templates retain the structure of the HTTP protocol and extract all variable parameter values. These templates record information related to seed mutation, thereby guiding the seed scheduling and mutation process more effectively. Seed template extension: Expand the seed template library by enriching data packets and extending field values. Use static analysis and prompts to analyze key code segments and partial request content to generate additional valid seed templates and field values. LLM-guided seed mutation: Seed templates are integrated in the initial design phase, which identify and mark the variable parts in HTTP packets; ChatHTTPFuzz first determines the type of the marked content, then applies targeted mutations to different fields, and combines the field values ​​extracted from the backend code to perform further mutations using the large language model LLM. The marked fields undergo additional mutations by the Radamsa tool to introduce greater randomness and unpredictability, further enriching the generated seed data; Seed scheduling: Optimize test results by intelligently selecting and managing input seeds. After generating a large number of seed templates, these seed templates are scheduled to balance the exploration and utilization stages to ensure that the seeds can trigger new code branches and make untested seeds more likely to be selected. Among them, exploration is to test seed templates that have not been fully evaluated to obtain more information and discover potential effective templates, and utilization is to select the best performing seed template based on existing data to maximize immediate benefits.

2. The Internet of Things HTTP fuzzy testing method based on a large language model as described in claim 1 is characterized in that: Data collection includes: 1) HTTP protocol data collection: Collect HTTP request and response examples related to IoT devices, including various request methods and their corresponding fields; and extract protocol specification information from existing protocol documents to make the generated test cases conform to the standards; 2) Service code collection: Obtain the backend code of IoT devices, including API implementation, business logic processing, and related configuration files; use static analysis tools to extract functions, variables, and control flow information in the code to identify key logic paths and potential test points; 3) Initial seed template collection: Collect existing test cases and seed templates, and analyze past test records to determine valid seed data formats and fields; 4) Runtime feedback information collection: During the fuzz testing process, the server’s response, error information, timeout, and feedback are recorded in real time; code coverage is monitored to evaluate the actual impact of the test cases on the code.

3. The Internet of Things HTTP fuzzy testing method based on a large language model as claimed in claim 1, characterized in that: The data preprocessing comprises the following steps: 1) Data cleaning: Clean the collected HTTP request and response data to remove invalid, duplicate or incorrectly formatted samples; 2) Data labeling: Use a large language model to label HTTP protocol data and identify key fields and variables; 3) Data conversion: During the data conversion phase, HTTP requests and responses need to be converted into a machine-readable format to ensure that they can be effectively processed by the fuzz testing tool; 4) Seed template extension: Generate variant data based on the initial seed template and use LLM to guide the generation of new seeds to ensure that these variant data still meet the requirements of the HTTP protocol; 5) Feature extraction: In the feature extraction stage, key features are extracted from HTTP protocol data and service codes, including field type, data format, and expected value range.

4. The Internet of Things HTTP fuzzy testing method based on a large language model as claimed in claim 1, characterized in that: The HTTP protocol structure uses the following method to improve the accuracy of variable identification in the protocol using LLM: 1) Temperature setting: Set the temperature parameter of LLM to 0 to ensure accurate extraction of information from the event; 2) Partial processing: The HTTP data packet is divided into the request header and the request body, and different prompts are designed according to the characteristics of each part to help LLM understand its grammatical structure and generate the required output; 3) Example learning: Using the example learning method, question-answering examples are used to clarify task requirements, help identify fields suitable for annotation, and define the basic components that must remain unchanged in the protocol and data structure; 4) Variable marking: In prompts and examples, use symbols to mark variable elements as the data source for generating seed templates.

5. The Internet of Things HTTP fuzzy testing method based on a large language model as claimed in claim 1, characterized in that: The seed template is generated using the packet information parsed by LLM. The seed template retains the structure of the HTTP protocol and extracts all variable parameter values. The template records information related to seed mutation. The structure mainly stores the following information: 1) Header and content annotation: Identify and annotate variables in the header and content data, use symbols to separate the annotated data from the original HTTP data, and record the exact location of the variable in the template; 2) Field collection: The field collection centrally manages all variable parameters and specifies the type of each field; 3) Variation space: A variation space is introduced for each identified field to store the potential value assignments inferred by LLM; 4) Mutation scoring: Record the seed scores for each round and calculate the scores regularly, giving priority to seeds that trigger more code branches and obtain higher scores; 5) Call count: Track the call count of each seed template to ensure that templates with fewer calls get more testing opportunities.

6. The Internet of Things HTTP fuzzy testing method based on a large language model as claimed in claim 1, characterized in that: Seed template extensions include: 1) Static analysis preprocessing: Before running ChatHTTPFuzz, static analysis preprocessing and asynchronous code analysis are performed based on seed information; the correspondence between routing code and backend code is analyzed in two modes: The first mode: table-based routing, using a centralized routing table or configuration file to manage all routing information, each URL path is explicitly mapped to a specific processing function or controller; The second mode: file-based routing, the structure of the file system determines the URL routing, and each URL path corresponds to a specific file; After determining the routing method, use IDA Python to extract the processing functions related to the routing information, and then save the decompiled code in the specified format in the folder configured by ChatHTTPFuzz to complete the static analysis preprocessing; 2) LLM-guided packet generation: Using the extracted routing information and code, a new request data packet is generated through LLM, and the protocol is parsed using protocol-aware technology to create a new seed template, and the prompt sequence provides instructions to enable LLM to generate multiple data packets consistent with the code logic; 3) LLM-guided field expansion: Field expansion is achieved through the following two methods: The first method is to identify the set of assignable values ​​of a variable. For IoT devices, a backend code block is used to call the GetVar function to retrieve POST parameters from the HTTP data packet. These parameters are compared through strcmp, and the code branches according to the results. By analyzing the code logic, LLM identifies these functions and extracts the corresponding valid string set, clarifies the possible parameter values, and generates a logical data packet so that the test data triggers the expected execution path. The second type is used to determine specific format requirements; LLM is used to identify and extend the format requirements of fields in request packets, ensure that fields are assigned valid values, and that certain parameters must follow format standards when generating packets; ChatHTTPFuzz uses the seed template structure to store the extended field set obtained by the above method to provide selection for seed mutation.

7. The Internet of Things HTTP fuzzy testing method based on a large language model as claimed in claim 1, characterized in that: The LLM-guided seed mutation includes the following steps: 1) Type-based mutation: For fields with numeric data types, mutation operations modify values ​​to boundary or extreme cases to evaluate the behavior of the system under extreme conditions. For fields using special encoding formats, a process of decoding, mutation, and re-encoding is used to keep the data complete and accurate during the test. 2) Intelligent variation based on contextual content: ChatHTTPFuzz uses LLM combined with seed template structure to mutate field values, achieving more accurate testing and improving code coverage; During this process, LLM first analyzes the backend code related to the HTTP packet to extract the actual usage and value set of the fields; then, ChatHTTPFuzz performs targeted mutations based on the VariationSpace variable that includes possible backend field values; 3) Other variations: 3-1) Processing of special characters: During the test, special characters in the encoding format are replaced, and null bytes, line feeds, carriage returns, and tabs are processed; 3-2) Mutation dictionary: Create a mutation dictionary that includes known attack payloads, randomly selected during mutation testing, including payloads for command injection, buffer overflow, and integer overflow targeting specific vulnerabilities; 3-3) Radamsa-based program mutation: Generate test cases by mutating input data, which cover a variety of boundary conditions and abnormal inputs.

8. The Internet of Things HTTP fuzzy testing method based on a large language model as claimed in claim 1, characterized in that: The seed template in the seed scheduling includes: 1) Historically successful mutation templates: This type of template has previously generated valid test cases, successfully triggered new program behaviors or discovered potential vulnerabilities; 2) Low-frequency call templates: This category of templates includes templates that are ignored for various reasons in multiple selections, as well as templates that are newly added to the template pool; 3) Rich variation space templates: This type of template includes multiple variable fields or complex structures, providing a wider range of exploration possibilities; For historically successful mutation templates, a seed selection algorithm based on Thompson sampling is used. This method updates the Bayesian posterior probability based on historical performance, balancing the relationship between exploring new templates and leveraging previously successful templates: For low-frequency templates, use the exploration balance factor to ensure that the system does not ignore templates with low calling frequency, especially newly added templates; For templates with rich mutation space, introduce mutation potential factors to predict the future performance potential of templates, enhance test innovation capabilities and the ability to discover complex vulnerabilities; 1) Seed selection algorithm based on Thompson sampling Assume that the prior distribution of N seed templates is expressed as , in the kth round, the fuzz tester collects feedback information, expressed as ,in Indicates the number of attempts with a reward of 0. represents the number of attempts with a reward of 1, where the reward indicates that a new branch has been successfully triggered or a vulnerability has been discovered. Based on the performance of each template in the first k rounds, the posterior distribution is updated to , used to predict Performance in round k + 1; 2) Explore the balancing factor EBF The core of this factor is to prioritize templates with low call frequency, while preventing the testing process from being completely dominated by rarely used templates: The EBF is defined as follows: ； in, Indicates the total number of calls of all templates, N is the total number of templates, and Respectively represent templates The number of successful and failed calls; 3) Mutation potential factor The mutation potential factor is used to evaluate the potential variability of the seed template. This factor measures the potential mutation space of the template by comparing the logarithmic ratio of the possible value set of each field of the current template with the maximum value set of all templates. The calculation formula is as follows: ； The numerator represents the mutation potential of the current template, while the denominator represents the maximum potential among all templates. Indicates the current template The size of the mutable field collection, and Represents the sum of the variable field sets of all templates; 4) Integration Introducing mutation potential factors and explore the balance factor ,pass and Adjust and amplify Thompson sampling results , the specific integration method is as follows: 。

Images