A Stateful Protocol Fuzzy Testing Method and System Based on Large Model-Based State Machine Construction

Abstract

This invention discloses a method and system for fuzzing stateful protocols based on a large-scale model to construct a state machine. The method first preprocesses the protocol specification document and uses prompts to guide the analysis of a large-scale information model to obtain state machine information. Then, an initial state machine is constructed using the large-scale state machine model, and the message dictionary is initialized. Next, protocol testing is performed based on the initial state machine. By inputting prompts into the test large-scale model, traffic logs are analyzed to derive a dictionary for supplementing and improving message fields. The message request fields and response codes in the message dictionary are combined to refine the initial state machine, resulting in a fine-grained state machine. Finally, based on the fine-grained state machine, prompts are input, and the analysis large-scale model analyzes the blind spots in the current test coverage, guiding the fuzzer to prioritize testing the uncovered states most likely to trigger deep vulnerabilities, thus completing the fuzzing test. This invention allows the fuzzer to test potentially high-potential test state areas in a targeted manner, enabling accurate and efficient fuzzing.

Description

Technical Field

[0001] This invention relates to the field of fuzz testing technology, specifically to a stateful protocol fuzz testing method and system based on a large model-constructed state machine. Background Technology

[0002] Fuzzing, as the most popular automated software vulnerability discovery technique today, boasts advantages such as high automation, low energy consumption, and high utilization of computing resources. Network protocol fuzzing is an automated testing method for network protocols. Network protocols are a series of specifications that define how computer devices communicate over a network, defining the format, order, and error handling of communication information, thus playing a crucial role in network infrastructure. Network protocols possess characteristics such as protocol state and highly structured input, which pose significant challenges during testing. Traditional fuzzing techniques cannot effectively identify state, typically only testing shallow functional areas in stateful protocol software, failing to find deep-seated code vulnerabilities.

[0003] Existing research on fuzzing based on stateful network protocols includes AFLNet (a gray-box fuzzer for network protocol testing), which proposes a fuzzing method for stateful protocols. AFLNet first proposes a gray-box fuzzing solution for stateful protocol implementations. AFLNet argues that the logic of a network protocol program in processing message requests is related to the context in which the request occurs. Therefore, in the process of testing a network protocol, it is necessary to first reach the target state for testing. However, status codes cannot fully represent the state of the protocol. AFLNet's response code scheme assumes that the protocol will embed special codes in the response message, but this is not always the case.

[0004] ChatAFL, the first method to use a large model in protocol testing, employs a large language model to assist in testing protocols. Based on knowledge acquired during pre-training, ChatAFL obtains the message syntax of the protocol under test and then uses this grammatical information as a template to optimize the test corpus and guide message variation. After fuzzing reaches a plateau, it further leverages the guidance of the large model to output communication messages that may improve test performance. However, ChatAFL only utilizes relevant information acquired during the pre-release training phase of the large models for each platform and does not play a role in protocol state structure construction. Summary of the Invention

[0005] This invention fundamentally addresses the limitations of existing methods by proposing a stateful protocol fuzzing method and system based on a large model-based state machine. It achieves highly efficient protocol fuzzing by constructing a dynamic, intelligent, and document-understanding-based systematic framework. This invention cleverly integrates the state awareness of AFLNet and the large model intelligence of ChatAFL, overcoming the state inference bottleneck of the former and the knowledge source bottleneck of the latter. By enabling the large information model to dynamically parse authoritative protocol specification documents (RFC documents), this invention can automatically construct a high-fidelity protocol state machine and an accurate message dictionary, thus providing a solid data foundation for generating high-quality test cases and performing deep state space navigation. Ultimately, this enables more efficient and in-depth vulnerability discovery and testing of stateful network protocols.

[0006] The technical problem to be solved by this invention is to provide a protocol fuzzing method that constructs a state machine based on a large model and guides testing. By processing and analyzing the specification documents followed by the protocol design through a large information model, the method constructs the state machine required for the protocol testing process. By analyzing the test log information, the method supplements and improves the state machine and evaluates the test value of each state within the state machine. This guides the fuzzer to select states that cover more program branches, thereby greatly improving the overall vulnerability detection efficiency of the fuzzing system.

[0007] The technical solution adopted in this invention mainly includes the following steps:

[0008] S1: Test preparation phase; preprocess the protocol specification document (RFC document), and use the best prompt words to guide the information big model to initially analyze the protocol specification document to obtain state machine information. Then, based on this information, construct the initial state machine using the state machine big model, and initialize a message dictionary based on the output results after document analysis.

[0009] S2: State machine refinement stage; Based on the initial state machine, protocol testing is performed. Real-time network traffic during the test is captured and analyzed. By inputting the selected prompt words from the prompt word pool into the test model, the traffic logs are understood to obtain the message fields of the communication and supplement the message dictionary. Then, by combining the message request fields and response codes in the message dictionary, the initial state machine is improved and corrected to obtain a fine-grained state machine.

[0010] S3: Large Model-Guided Testing Phase; Based on a fine-grained state machine, the input prompt word is used to analyze the blind spots of the current test coverage, generate a "set of interesting states", and guide the fuzz tester to prioritize testing those uncovered states that are most likely to trigger deep vulnerabilities, thus completing the fuzz test.

[0011] Preferably, the test preparation phase S1 specifically includes the following steps:

[0012] S1.1: Create a set of RFC documents for the protocol and build a mapping—from the protocol name to the protocol specification document—to extract and preprocess the documents in the set.

[0013] S1.2: Based on the state information in the preprocessed protocol specification RFC document, design the format definition of the state machine transition diagram. Supplement the state information into the prompt word pool to optimize the prompt words. Sort the prompt words according to their completeness of state machine information based on their scores, selecting the top k prompt words. Then, input these prompt words into the information big data model, utilizing the pre-trained knowledge of the information big data model to output the state machine information.

[0014] S1.3: Large-scale model analysis constructs the state machine. The protocol specification RFC document and state machine information are input into the large-scale state machine model to construct an initial state machine. Combined with the efficient processing of document information by the large-scale information model, the large-scale state machine model organizes the message fields in the protocol specification RFC document, creating and updating the resulting message dictionary in real time. The large-scale information model obtains new state machine information through analysis of the RFC document. During iterative processing of the document, it can analyze the completeness of the state machine and update the state machine model in real time.

[0015] Preferably, the state machine refinement stage S2 is implemented as follows:

[0016] S2.1: Deploy the program of the protocol entity under test on the server test platform, start the program of the protocol entity under test and the corresponding communication terminal, and conduct tests based on the initial state machine. During the test, use a network sniffing tool to capture network traffic between the protocol entity program under test and the fuzzer.

[0017] S2.2: Based on network traffic, supplement and maintain the dictionary of message requests through regular expression matching. At the same time, filter the network traffic information according to the request field of the message type to obtain a simplified test log file, and then use this file as the input content of the large test model.

[0018] S2.3: The test process is analyzed by processing the test log file of the large test model using the prompt word. This analysis includes the message requests from the fuzzer (client) and the responses from the server. The fuzzer constructs a mapping table to store the received response codes and their corresponding request messages. Then, the state machine information is supplemented and improved by combining the request messages and response codes in the messages, thus depicting the state machine transition diagram in a more granular manner.

[0019] The preferred implementation of S3 in the large model-guided testing phase is as follows:

[0020] S3.1: By querying the large model's test logs using the prompt word, the current test coverage of the protocol under test evaluated by the large model is obtained. The specific content covers a series of states that have been deeply tested. By subtracting the tested states from the recorded state set, the range of states that have not been fully tested can be obtained. The incompletely tested states are organized into an interesting state set to guide the second half of the protocol fuzzy testing. At the same time, the instrumentation module integrated into the protocol test can be used to obtain the execution status of each program branch and code block during the test.

[0021] S3.2: Then, based on the difficulty of triggering new paths in the incompletely tested state range obtained in the previous step and the number of times the program statements of the protocol implementation are executed, the coverage information is calculated. The interesting value of the state in the interesting state set is intuitively represented by recording the number of new program branches executed in different test states. The states in the set are traversed one by one in descending order of interesting value. If there are several states with the same interesting value in the state set, a state is randomly selected for testing, and finally the fuzz test is completed.

[0022] This invention also implements a stateful protocol fuzzy testing system based on a large model to construct a state machine, including the following modules:

[0023] The document processing module is used to preprocess the original RFC document and output clean, segmented plain text data blocks.

[0024] The prompt word management module is used to maintain a prompt word pool and evaluate the effectiveness of different prompt words through iterative testing to select the best prompt word.

[0025] The state machine construction module receives plain text data blocks and the best prompt words, and constructs an initial state machine using a large state machine model.

[0026] The request dictionary maintenance module, based on the parsing capability of the state machine model for RFC documents, extracts message fields from the message through the prompting process and stores them in a structured manner in an updatable message dictionary.

[0027] The protocol testing module performs protocol testing based on the initial state machine. By inputting the optimal prompt words into the large test model, it understands the traffic logs, improves the message dictionary, and refines and corrects the initial state machine by combining the message request fields and response codes in the message dictionary, thus obtaining a fine-grained state machine.

[0028] The test guidance module, based on a fine-grained state machine, analyzes the blind spots of the current test coverage by analyzing the large model, generates a set of interesting states, and guides the fuzz tester to prioritize testing the uncovered states that are most likely to trigger deep vulnerabilities, thus completing the fuzz test.

[0029] Compared with other fuzz testing tools, this invention has the following characteristics and technical effects:

[0030] This invention is based on large-model analysis of the RFC documents followed in the protocol design. According to the logic of server request processing within the documents, a preliminary state machine of the protocol is constructed. During the fuzzing phase, the large model analyzes the traffic during the testing process to enrich the protocol's request fields. Then, the request and protocol state machines are combined to characterize the state machine in a fine-grained manner. Finally, the refined state machine serves as a guide, allowing the fuzzer to test potentially promising test state regions in a targeted manner. When constructing the state machine, when faced with the dilemma of the fuzzer lacking understanding of the protocol under test and needing to build the protocol state transition diagram from scratch, this invention's construction method leverages the protocol knowledge acquired by the large model during pre-training and its document processing capabilities to process the RFC documents. Then, based on the protocol information provided by the large model, a complete state machine is built for accurate and efficient fuzzing.

[0031] To ensure the accuracy of the state machine, this invention employs a large language model as an aid and bases the guidance strategy in the protocol fuzzing phase on the state machine. Furthermore, message processing is used to enrich the state machine's information and improve test effectiveness. This invention significantly increases the code statements and branch count covered by large-model-based protocol fuzzing, solving the problem of high message error rates in existing protocol testing fuzzers. Attached Figure Description

[0032] Figure 1 A flowchart for establishing a preliminary state machine by preprocessing documents during the test preparation phase of this invention;

[0033] Figure 2 This is a flowchart illustrating the fuzzy testing phase of the present invention, which is guided by a large model based on a fine-grained state machine.

[0034] Figure 3 This is a schematic diagram illustrating the fine-grained construction of a state machine by combining message request fields with status codes according to the present invention.

[0035] Figure 4 This is the result of three tests (24 hours each) conducted on two FTP protocol implementations for this invention. Detailed Implementation

[0036] The present invention will now be described systematically and completely with reference to the accompanying drawings.

[0037] This invention is mainly divided into three stages. The first stage is the test preparation stage, in which the protocol document is processed before the fuzz test begins. Then, the second stage (state machine improvement stage) and the third stage (large model guided test stage) are the fuzz test stages. The two stages complement each other. After the state machine is improved, the large model guides the fuzzer to conduct tests based on this state machine.

[0038] like Figure 1 As shown, the present invention includes the following steps in the test preparation stage:

[0039] S1: Test Preparation Phase

[0040] S1.1: The user prepares a series of protocol RFC specification documents in advance, creates a document set for the protocol, and constructs a mapping within the document set—a mapping from protocol names to protocol specification documents. Then, the documents in the document set are extracted and preprocessed. Effective preprocessing of RFC documents ensures that the documents accurately represent the model machine's relevant information. Several protocol RFC specification documents are combined to form a document set. Then, the document is cleaned and divided into appropriate blocks. Document cleanup removes irrelevant content such as headers, footers, and introductions from the RFC document; document block division divides the document into overlapping blocks of 1000 tokens—200 characters each. This step completes the preprocessing of the document.

[0041] S1.2: The generative large model analyzes each document after preprocessing in the previous step, and combines this with the content obtained from the pre-training of the information large model to generate the protocol's state machine information. Based on this state machine information, the format definition of the state machine transition diagram is designed, and this content is stored as prompt words in the prompt word pool. This invention represents the state machine format as a quintuple. ,in It is a non-empty set of predefined messages in the protocol implementation. It is a non-empty set consisting of all the states of the protocol, and It is the set of all initial states in the state set, therefore we have ,and It is a state transition function that indicates how a sequence of messages in a protocol can transition the protocol from one state to another. It is a set consisting of all state transition relations. Indicates when the protocol is in state I received the message. It will transition to a state The definition of a state machine can be used to examine the transition relationships between different states during protocol implementation.

[0042] S1.3: The content obtained in the previous step is used as a prompt and input into the state machine model. The pre-trained knowledge of the state machine model is used to obtain a simplified initial state machine. Simultaneously, by inputting the RFC document and state machine information into the state machine model, and leveraging its efficient processing capabilities for document information and corresponding prompts, the information model organizes the message fields in the RFC document related to the messages, creates and maintains a message dictionary that is updated in real time, preparing for subsequent testing. The large model obtains a new state machine diagram by analyzing the protocol specification RFC document. During iterative processing of the document, it can analyze the completeness of the state machine and update it in real time.

[0043] like Figure 2 As shown, in the fuzz testing phases (S2 and S3), this invention guides the testing of large models based on fine-grained state machines.

[0044] S2: State machine refinement stage:

[0045] The state machine improvement stage described in this invention specifically includes the following steps:

[0046] S2.1: After deploying the protocol under test on the test platform, start the protocol program and the corresponding communication terminal, and conduct tests based on the initial state machine. Use common network tools such as packet capture software to capture the network traffic between the protocol under test entity program and the fuzzer, and then save the network traffic to a .pcap format file for subsequent analysis and processing.

[0047] S2.2: Parse the .pcap file obtained in the previous step to get readable session information (network traffic). Then, filter and organize the session information, expanding the message request dictionary through regular expression matching. The message request dictionary consists of document content related to the protocol under test. The fuzzer acts as the test client, sending requests to the server. The sent messages can be distinguished by fixed fields of the request type. After receiving the message content, the server will process it according to different response logics based on different requests. The message messages are continuously updated during the test. At the same time, the network traffic information is filtered according to the request fields of the message type to obtain a simplified test log file, which is then used as the input content for the large test model.

[0048] S2.3: By using the prompt word, the test model is required to analyze the test log file to understand the test process. During the test, the message requests of the fuzzer (client) and the responses returned by the server are analyzed. The fuzzer will build a mapping table for the test information to store the received response codes and corresponding request messages. The state machine transition diagram is described in fine granularity by combining the request fields and response codes in the messages.

[0049] Figure 3This diagram illustrates the state transitions after a Live555 implementation of the Real-Time Streaming Protocol (RTSP) sends a message and receives a service response. The fields OPTIONS, SETUP, and PLAY in the message represent different requests sent by the client, corresponding to functions such as sending options, setting, and playback. Status codes 200 and 400 represent the server's response to the message; status code 200 indicates a normal request, while status code 400 indicates an invalid request. The server executes different code blocks in different states. After parsing the received message, the server enters the corresponding processing logic based on the type of the message request fields. It can be seen that with the original coarse-grained state characterization method, the fuzzer could not distinguish the states of the server receiving "OPTIONS," "SETUP," and "PLAY" messages and mistakenly identified them as the same state. In fact, the server executes different code paths when processing these messages, indicating completely different states. Therefore, combining state with message fields to refine the state granularity is beneficial for improving test coverage.

[0050] S3 Large Model Bootstrapping Testing Phase:

[0051] S3.1: By querying the large model using the prompt word, the test coverage of the protocol under test is obtained. The specific content covers a series of states that have been deeply tested. By subtracting the tested states from the recorded state set, the range of states that have not been fully tested can be obtained. The incompletely tested states are organized into an interesting state set to guide the fuzzy testing of the protocol in the second half. At the same time, the execution status of each program branch and code block during the test is obtained based on the instrumentation program module integrated into the test tool.

[0052] S3.2 Based on the execution status of the program and code blocks obtained in the incomplete test state in the previous step, the test coverage feedback information is represented. Then, the interesting value of the state in the interesting state set is calculated based on this information. The interesting value of the state in the interesting state set is intuitively represented by recording the number of new program branches executed in different selected states. The states in the set are traversed one by one in descending order of interesting value. If there are several states in the state set with the same interesting value, a state is randomly selected for testing. The main task of this stage is to enable deep testing to trigger states with higher code coverage and to update the interesting value of each state synchronously, thus completing the fuzz test.

[0053] In a second aspect, the present invention provides a protocol fuzzing testing system based on a large model-constructed state machine. The system is used to run the aforementioned stateful protocol fuzzing method based on a large model-constructed state machine, comprising:

[0054] The document processing module takes the original RFC document (PDF / TXT) as input and outputs cleaned, chunked plain text data blocks. Its processing flow first establishes a HashMap (or database table) mapping protocol names to their RFC document file paths as a global document index. Then, it uses rule-based methods (such as regular expressions) to remove irrelevant noise such as headers, footers, and page numbers. Finally, it implements a chunking algorithm that divides each document into 1000 smallest semantic units (tokens) (approximately 750 characters) and sets an overlap region of 200 tokens to ensure contextual coherence. This algorithm must be able to handle text boundaries to prevent critical information from being fragmented.

[0055] The prompt word management module is implemented as a prompt word experimentation and evaluation framework. It maintains a prompt word pool and evaluates the effectiveness of different prompt words through iterative testing. Its processing flow involves first providing or generating multiple sets of candidate prompt words containing state machine format (such as DOT language) definitions. Then, each set of prompt words is used to call a large model to process sample documents and generate state machine descriptions. Finally, the completeness and accuracy of the generated state machines are quantitatively evaluated, and the best prompt word is selected for use by subsequent modules.

[0056] The state machine construction module is implemented as a core analysis service. It relies on the Collections-C library to build and manage complex states and transition relationships in memory (e.g., using a hashmap (array-linked list) to store states and a list to store transition conditions). Its workflow is as follows: First, it receives clean text from the document processing module and the best prompts from the prompt word management module. Then, it calls the information big model for analysis, parses the DOT (Graphical Description of Graphs) description output by the information big model, and calls the state machine big model to dynamically build and update the state machine in the program using Collections-C data structures. Simultaneously, it integrates the Graphviz library to render the in-memory state machine as an image (such as a PNG image or SVG file) in real time, allowing users to intuitively monitor the analysis progress.

[0057] The request dictionary maintenance module leverages the intelligent parsing capabilities of a state machine model for RFC documents. Through specific prompts, it automatically extracts message fields from messages and stores them in a structured manner in a real-time updated message dictionary. This provides accurate and reliable data support for the generation and execution of subsequent test cases. This module interacts with upstream and downstream stages of the testing process, providing field-level data support throughout the entire testing process.

[0058] Protocol testing module: Based on the initial state machine, protocol testing is performed. During fuzz testing, real-time network traffic is captured and analyzed. By inputting the prompt word into the large test model, the network traffic during the test process is analyzed and recorded to obtain the message messages of incoming and outgoing communication to supplement and improve the dictionary. Then, by combining the message request fields and response codes in the message dictionary, the initial state machine is improved and corrected to obtain a fine-grained state machine.

[0059] The test guidance module, specifically the large model-guided test phase, is the latter half of the protocol fuzzing process. Based on a fine-grained state machine, it first queries the large model and obtains the current test coverage state set through instrumentation. This set is then compared with the complete state machine generated by the state machine construction module, and the difference is calculated to obtain the "untested state set." Next, based on coverage information (such as the ease of triggering new paths), an "interesting value" is calculated for each state, and these values ​​are sorted in descending order. The fuzz tester is then scheduled to prioritize testing states with high interesting values, and the interesting values ​​of each state are dynamically updated based on the test results, achieving feedback-driven automated testing.

[0060] The above-described specific embodiments are only used to further illustrate the present invention and are not the only implementation of the present invention, nor should they be construed as limiting the present invention.

[0061] This invention instrumentes the target protocol entity program during compilation, extracting coverage information along the execution path. This method is effective for all target protocol entity programs that provide RFC documentation. To verify this invention, experimental verification was conducted using implementations of widely used protocols including RTSP, FTP, and DICOM. These included PureFTPD and ProFTPD for FTP, Live555 for RTSP, and DCMTK for DICOM. The control group used the basic stateful protocol fuzzer AFLNet and ChatAFL, the first protocol fuzzer utilizing a large model. Each test lasted 24 hours. To reduce the impact of randomness in fuzz testing, all experiments were repeated three times, and the average results were taken. The experimental results are shown in Table 1.

[0062] Table 1. Status Results of Protocol Test

[0063]

[0064] Comparative experiment, Figure 4 The results of fuzz testing using different fuzzers on two implementations of the FTP protocol are shown.

[0065] Table 1 shows the number of states tested in 24 hours using the method of this invention and other fuzzers, along with the year-on-year improvement ratio. It can be seen that the state coverage of this invention is significantly improved compared to the control method.

[0066] Table 2. State transition results of protocol test

[0067]

[0068] Table 2 shows the number of state transitions and the year-on-year improvement ratio of the method of this invention compared to other fuzzers tested over 24 hours. It can be seen that the number of state transitions in this invention is significantly higher than the control method.

[0069] Table 3 Branch Coverage Results of Protocol Testing

[0070]

[0071] Table 3 shows the branch coverage and year-on-year improvement ratio of the method of this invention compared with other fuzzers tested over 24 hours. It can be seen that the branch coverage of the method of this invention is significantly improved compared to the control method.

[0072] In summary, the stateful protocol fuzzy testing method based on large model-constructed state machines proposed in this invention significantly outperforms existing methods such as AFLNet and ChatAFL in multiple test metrics. Specifically:

[0073] In terms of state coverage, this invention improves by an average of 27.27% compared to AFLNet and 6.17% compared to ChatAFL; in terms of the number of state transitions, this invention improves by an average of 48.75% compared to AFLNet and 9.40% compared to ChatAFL; and in terms of branch coverage, this invention improves by an average of 12.54% compared to AFLNet and 5.61% compared to ChatAFL.

[0074] In addition, this invention also performs well in terms of testing efficiency (speed improvement factor), especially in state transition testing, where it improves by up to 243 times compared to AFLNet, fully demonstrating its powerful potential in testing highly complex protocols.

[0075] Experimental results show that this invention significantly improves both testing depth and efficiency compared to existing mainstream methods. Compared to AFLNet, state coverage is improved by an average of 27.27%, the number of state transitions by an average of 48.75%, and branch coverage by an average of 12.54%; compared to ChatAFL, state coverage is improved by an average of 6.17%, the number of state transitions by an average of 9.40%, and branch coverage by an average of 5.61%. This fully verifies the superior advantages of this invention in improving the targeting, effectiveness, and depth of fuzz testing for stateful protocols, effectively solving the problems of low testing efficiency and limited vulnerability discovery capabilities of traditional methods.

[0076] The above results consistently demonstrate that this invention, by integrating dynamic parsing of protocol specification RFC documents, fine-grained state machine construction, and large-model guided testing strategies, effectively solves the bottlenecks of traditional methods in state inference and knowledge updating, providing a reliable technical path for achieving more efficient and in-depth vulnerability mining of stateful protocols.

[0077] The foregoing has shown and described the basic principles, main features, and advantages of the present invention. Those skilled in the art should understand that the present invention is not limited to the above embodiments. The embodiments and descriptions in the specification are merely preferred examples of the invention and are not intended to limit the invention. Various changes and modifications can be made to the invention without departing from its spirit and scope, and all such changes and modifications fall within the scope of the present invention as claimed. The scope of protection of the present invention is defined by the appended claims and their equivalents.

Claims

1. A stateful protocol fuzzing method based on a large model constructing a state machine, characterized in that, Comprise the following steps: S1: pre-process the protocol specification document RFC, and guide the information large model with prompt to analyze the RFC document to obtain state machine information, and then use the state machine large model to construct an initial state machine, and initialize a message dictionary; S2: based on the initial state machine, perform protocol testing, and combine the message request field and response code in the message dictionary to obtain a fine-grained state machine; During the protocol testing process, real-time network traffic is captured and analyzed, the traffic log is understood by inputting the prompt to the test large model, the message dictionary is supplemented and perfected, and then the initial state machine is perfected and corrected in combination with the message request field and response code in the message dictionary, to obtain a fine-grained state machine; S3: based on the fine-grained state machine, input the prompt, analyze the blind area covered by the current test by the analysis large model, generate an interesting state set, and guide the fuzzy tester to preferentially test the uncovered state most likely to trigger deep vulnerabilities, complete the fuzzy test, and the specific implementation is as follows: S3.1: ask the analysis large model to analyze the test log through the prompt, obtain the current test coverage range of the large model evaluated protocol under test, the specific content covers a series of deeply tested states, the difference between the recorded state set and the tested state can obtain the state range that is not completely tested, the state range that is not completely tested is arranged into an interesting state set to guide the subsequent protocol fuzzy test, and the execution of each program branch and code block in the test can be obtained by using the plug-in program module integrated in the protocol test; S3.2: according to the difficulty of triggering new paths in the state range that is not completely tested, the program statement execution times of the protocol implementation, calculate the coverage rate information, intuitively represent the interesting value of the states in the interesting state set by recording the number of new program branches executed in different states, and traverse the states in the set in descending order according to the interesting value, if there are several states with the same interesting value in the state set, a state is randomly selected for testing, and the fuzzy test is completed.

2. The stateful protocol fuzzing method based on large model constructed state machine according to claim 1, characterized in that, The specific implementation process of step S1 is as follows: S1.1: create a set of RFC documents of the protocol, and construct a mapping from the protocol name to the protocol specification document, pre-process the documents in the document set; S1.2: according to the state information in the pre-processed protocol specification RFC document, design the format definition of the state machine transition graph; supplement the state information to the prompt pool to optimize the prompt, sort the information integrity of the state machine according to the prompt, select the first k prompts, then input the prompt to the information large model, and output the state machine information by using the pre-training knowledge of the information large model; S1.3: input the RFC document and state machine information into the state machine large model, build an initial state machine, the state machine large model organizes the message fields in the message in the protocol specification RFC document, creates and updates the message dictionary composed of message fields in real time; the information large model analyzes the RFC document to obtain new state machine information, and analyzes the integrity of the state machine in the iterative processing of the document and updates the state machine model in real time.

3. The stateful protocol fuzzing method based on large model constructed state machine according to claim 2, characterized in that, The specific implementation process of the step S2 is as follows: S2.1: deploy the program of the tested protocol entity on the server test platform, start the tested protocol entity program and the corresponding communication end, and test based on the initial state machine, wherein the network traffic between the tested protocol entity program and the fuzzer is captured by using a network sniffing tool during the test; S2.2: according to the network traffic, the dictionary library of the message request is supplemented and maintained through regular expression matching, and the network traffic information is filtered to obtain a test log file according to the request field of the message type of the message, and the file is used as the input content of the test large model; S2.3: the test large model is required to process the test log file and analyze the test process through the prompt, analyze the message request of the fuzzer and the response returned by the server in the test process, the fuzzer constructs a mapping relationship table for storing the received response code and the corresponding request message, and then the state machine information is supplemented and perfected through the combination of the request message and the response code in the message, so as to depict the state machine transition graph in a more fine-grained form.

4. A stateful protocol fuzzing system based on large model constructed state machine, for implementing the stateful protocol fuzzing method of any one of claims 1 to 3, characterized in that, The following modules are included: A document processing module for preprocessing the original RFC document to output clean and blocked pure text data blocks; A prompt word management module for maintaining a prompt word pool and selecting the best prompt word by evaluating the effects of different prompt words through cyclic testing; A state machine modeling module for receiving pure text data blocks and the best prompt word, and constructing an initial state machine through a state machine large model; A request dictionary maintenance module for extracting message fields in the message based on the analysis capability of the state machine large model on the RFC document through a prompt engineering, and structuring and storing the message fields in an updateable message dictionary; A protocol test module for testing the protocol based on the initial state machine, understanding the traffic log by inputting the optimal prompt word into the test large model, perfecting the message dictionary, combining the message request field and the response code in the message dictionary to perfect and correct the initial state machine, and obtaining a fine-grained state machine; A test guiding module for analyzing the blind area covered by the current test based on the fine-grained state machine, generating an interesting state set, guiding the fuzzer to preferentially test the uncovered state most likely to trigger a deep vulnerability, and completing the fuzz testing.

5. The stateful protocol fuzzing system based on large model constructed state machine of claim 4, wherein, The document processing module is specifically implemented as follows: first, a database table of protocol names to their RFC document file paths is established as a global document index, then regular expressions are used to remove noise, and finally a blocking algorithm is used to segment each document and set an overlapping area.

6. The stateful protocol fuzzing system based on large model constructed state machine of claim 5, wherein, The test guide module is specifically implemented as follows: firstly, the analysis large model is inquired and the state set obtained by plugging is compared with the complete state machine generated by the state mechanism modeling module, the difference set is calculated to obtain the untested state set, the interesting value of each state is calculated according to the coverage information, and the values are sorted in descending order, then the fuzzy tester is dispatched to preferentially test the high interesting value state, and the interesting value of each state is dynamically updated according to the test result, so that the feedback-driven automatic test is realized.

Images