Byte-level fuzz testing method based on large language model
By constructing a standard fuzzing benchmark and a byte-level mutation strategy for a large language model, the blindness and format dependency problems of traditional fuzzing in IoT systems are solved, achieving efficient and resource-saving vulnerability detection and improving the vulnerability triggering capability in the IoT environment.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-12-02
- Publication Date
- 2026-04-10
AI Technical Summary
Traditional fuzz testing methods in IoT systems suffer from problems such as strong blind mutation, high format dependence, and insufficient semantic understanding, making it difficult to generate high-value test cases. Especially in the industrial IoT environment with limited resources and high real-time requirements, how to use large language models for effective byte-level mutation remains a key problem that needs to be solved.
We construct a fuzzy testing benchmark for the file format standards of core functional components of the Industrial Internet, collect historical operating data and train the model, combine a large language model (LLM) to predict byte-level mutation strategies, perform self-optimizing fuzzy testing through feedback sequence updates, and use an encoder-decoder or decoder-only framework for supervised fine-tuning to generate high-value test cases.
It significantly improves testing efficiency and resource utilization, reduces invalid mutations, enhances migration capabilities and effective mutation rate across multiple input formats, can identify and attack key segment sections, expands the test state space and boundary condition coverage, and increases the probability of vulnerability triggering.
Smart Images

Figure CN121833488A_ABST
Abstract
Description
TECHNICAL FIELD
[0001] The present application relates to the field of network space security and software vulnerability detection technology, in particular to a byte-level fuzz testing method based on a large language model. BACKGROUND
[0002] Fuzz testing is a dynamic program analysis technique that involves inputting abnormal or randomly generated data into target programs to discover potential vulnerabilities. It is widely used in vulnerability detection for network protocols, security software, and Internet of Things (IoT) devices. However, traditional fuzz testing methods mainly rely on heuristic or random mutation strategies, which generate test samples that lack specificity and are difficult to effectively cover the critical paths of programs.
[0003] Current mainstream fuzz testing tools such as American Fuzzy Lop (AFL) and its derivative versions AFL++, AFLSmart, etc., have improved testing efficiency through coverage-guided mechanisms, but still have the following shortcomings in complex IoT systems: strong variation blindness: random or semi-random variation leads to a large number of invalid inputs, reducing the probability of vulnerability triggering; high format dependency: different data formats (such as ELF, XML, audio / video streams) require manual customization of parsing rules; insufficient semantic understanding: existing fuzz testing tools lack the ability to model program logic and byte semantics, making it difficult to generate high-value test cases.
[0004] With the development of deep learning technology, researchers have attempted to introduce recurrent neural networks, generative adversarial networks, and sequence-to-sequence models to improve the fuzz testing process. However, due to limitations in model capacity, training data, and generalization ability, these methods have limited effectiveness in IoT security scenarios. Large language models have shown excellent code understanding and generation capabilities in tasks such as code generation, automatic completion, and program repair, providing a new direction for the intelligentization of fuzz testing. In recent years, systems such as Fuzz4All, TitanFuzz, and FuzzLLM have attempted to use large models to generate test cases or optimize mutation strategies, but most focus on the function level or API level, and have not yet formed a unified byte-level guidance mechanism. In particular, in resource-constrained and real-time industrial IoT environments, how to effectively use LLM for byte-level mutation remains a key problem to be solved. SUMMARY
[0005] To overcome the shortcomings of the prior art, the present application provides a byte-level fuzz testing method based on a large language model, which reduces the occupation of a large number of low-yield mutations on computing resources, and solves the above technical problems.
[0006] To achieve the above purpose, the present application provides the following technical solution: a byte-level fuzz testing method based on a large language model, comprising the following steps: S1: Construct a standard fuzz testing benchmark for the file format of the industrial internet core functional component and collect and organize historical running fuzz testing data to construct a model training set and a validation set; S2: Based on the data of S1, take the byte sequence as input, the mutation position and mutation strategy as output, use the training framework to construct the input and output into a unified sequence learning task, and combine the prompt engineering and LLM API to supervise the fine-tuning of the data set to complete the model training, and obtain the fine-tuned model after training; S3: Based on the fine-tuned model after training, perform byte mutation, combine feedback sequence to update mutation strategy, and continuously cycle self-optimization fuzz testing.
[0007] As a preferred technical solution of the present application, S1 comprises the following steps: S11: Obtain a fuzz testing target program based on the industrial internet core functional component; S12: Deploy the fuzz testing benchmark corresponding to the fuzz testing target program of the industrial internet core functional component in S11; S13: Obtain detailed description of each fuzz testing, and run the plug-in compilation and running analysis through the benchmark fuzz tester AFL; S14: Use the benchmark fuzz tester AFL to perform fuzz testing on the industrial internet core functional component and collect the effective mutations output during the testing process; S15: Data structure of the operation instruction of the guided mutation in the fuzz testing process, the test case sequence for fuzz testing, and the generated effective mutation strategy are processed to form a supervised training triple; S16: Based on the supervised training triple output by S15, construct a corresponding instruction corpus set : Among them, represents the instruction in the training data tuple, represents the test case for fuzz testing in the training data tuple, represents the effective mutation set in the training data tuple, represents the scale of the training data, and the instruction corpus set is the historical fuzz testing data set of the industrial internet functional component; S17: Randomly select 90% of the sample data in the historical fuzz testing data set of the industrial internet functional component as the training set, and 10% of the sample data as the validation set.
[0008] As a preferred technical solution of the present application, S2 comprises the following steps: S21: Accept the historical fuzzy test training dataset of industrial internet functional components from S17, take the byte sequence as input, and the mutation position and mutation strategy as output to build two training frameworks; S22: Construct a supervised fine-tuning model by combining prompt word engineering with LLM API and historical fuzzy test training dataset of industrial internet functional components; S23: Encapsulate the fine-tuning model as a RESTful API service.
[0009] As a preferred technical solution of the present invention, the training framework in S21 includes an encoder-decoder framework and a decoder-only framework; The specific expression of the encoder in the encoder-decoder framework is as follows: in, This indicates that the outputs of group A's attention head will be concatenated. This indicates that attention should be paid to the number of heads. Indicates the first One thing to note: Indicates the Softmax function, superscript Indicates transpose. Represents the self-attention function. This represents the input to the entire self-attention layer. This represents a bidirectional encoder mask matrix. , , , These represent the query matrix, key matrix, value matrix, and scaling factor, respectively. The final output of the encoder-decoder framework is a context-aware representation sequence. This indicates element-wise multiplication. In the encoder-decoder framework, the decoder generates the target token based on the output order of the encoder, serving as the mutation position and mutation strategy with prediction. The decoder-only framework directly maps the input to the prediction sequence, as shown in the following expression: in, This represents a bidirectional encoder mask matrix with a random mask. Represents the self-attention function. This indicates the final output of the decoder framework, where the decoder generates the target token based on the attention coefficients of the hidden state, serving as the mutation location and mutation strategy with prediction.
[0010] As a preferred embodiment of the present invention, step S22 includes the following steps: S22.1: Set the prompt content, including task description, mutation operation, input sequence definition, output sequence definition and input sequence template; S22.2: Organize the input sequence template into structured data in JSON format, normalize the samples in the historical fuzz testing data set according to the template through a script, call the LLM API in a loop, pass the structured input data into the supervised fine-tuned LLM model, obtain the model output in real time, parse and format the returned content, extract the preset output fields, and record the results to form a fine-tuned sample pair.
[0011] As a preferred technical solution of the present application, the S3 comprises the following steps: S31: Select input files from a public vulnerability database that can trigger exceptions and cover specific code paths to form an initial seed pool; S32: Send the test cases generated in the industrial internet function component fuzz testing process to the fine-tuned large model for byte-type mutation, obtain mutation suggestions composed of mutation positions and mutation strategies, and select the top-k mutation positions and corresponding mutation strategies based on the probability of mutation suggestions using the Top-k sampling strategy; S33: Receive the list of mutation positions predicted by the model And the corresponding mutation strategy list After that, the bytes at the specified positions in the test cases will be operated according to the strategy defined, and after the mutation is completed, the new test cases generated will be executed in the target program, and the mutated test cases will be marked according to the test feedback to obtain a labeled data pair as a feedback sequence; Wherein, respectively represent the first ~k mutation positions obtained by using the Top-k sampling strategy, respectively represent the first ~k mutation strategies obtained by using the Top-k sampling strategy; S34: Collect the labeled data pairs generated in S33 to form an incremental data set, and periodically use the incremental data set to perform incremental fine-tuning on the deployed fine-tuned model.
[0012] Compared with the prior art, the present application provides a byte-level fuzz testing method based on a large language model, which has the following beneficial effects: 1. This invention formalizes the byte-level mutation problem into a sequence-to-sequence generation task. It innovatively introduces a code-based large language model to jointly predict mutation locations and strategies. This method effectively reduces invalid attempts caused by blind mutation, increases the probability of reaching new paths and triggering anomalies per unit time, thereby significantly improving testing efficiency and resource utilization. It directly performs strategy judgment and location selection at the byte level, and can identify and prioritize attacking key byte segments that can cause logical anomalies or memory errors. This byte-level fine-grained decision-making replaces the traditional random bit flipping or global byte replacement, which significantly increases the proportion of effective mutations (EPM) and reduces the computational resource consumption of a large number of low-yield mutations.
[0013] 2. This invention proposes a dedicated historical fuzzy test dataset for industrial internet functional components. By extracting the "original sample - effective mutation location - mutation strategy" tripartite pair from real fuzzy history for fine-tuning, the model can learn high-value mutation patterns even with few samples, significantly improving the model's transferability and effective mutation rate across various input formats (ELF, XML, MP3, GIF, etc.). Simultaneously, it proposes a seed enrichment mechanism based on historical vulnerability features. By enabling the LLM to learn the triggering semantics and mutation patterns of historical vulnerabilities, this invention can automatically synthesize high-value initial seeds rich in attack features, expanding the test state space and boundary condition coverage, and increasing the probability of triggering deep defects from the source. Attached Figure Description
[0014] Figure 1 This is a schematic diagram of the method flow of the present invention; Figure 2 This is a schematic diagram of the tool framework in this invention; Figure 3 This is a schematic diagram of data collection and preprocessing in this invention; Figure 4 This is a schematic diagram illustrating the model construction and training process in this invention; Figure 5 This is a schematic diagram of the byte-level mutation test in this invention. Detailed Implementation
[0015] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.
[0016] Please see Figures 1-5 A byte-level fuzzing method based on a large language model includes the following steps: S1: Construct a standard fuzzy testing benchmark for the file format of core functional components of the Industrial Internet and collect and organize historical fuzzy testing data to build model training and validation sets; S2: Based on the data in S1, the data is taken as a byte sequence as input, and the mutation position and mutation strategy are taken as output. The training framework is used to construct the input and output into a unified sequence learning task. The dataset is then supervised and fine-tuned using cue engineering and LLM API to complete the model training (the autoregressive decoder architecture is preferred to construct the mapping problem into a unified sequence learning task, and the dataset is then supervised and fine-tuned using cue engineering and LLM API to complete the model training) to obtain the trained fine-tuned model. S3: Based on the fine-tuned model after training, perform byte-type mutations, combine with a feedback sequence update mutation strategy, and continuously iterate and self-optimize fuzz testing.
[0017] S1 includes the following steps: S11: Obtain fuzzing target programs based on core functional components of the Industrial Internet: Determine the fuzzing target programs based on core functional components of the Industrial Internet. In this embodiment, the specific target programs are eight key components in the binutils toolchain: nm, readelf, objdump (all used to parse ELF format), and tools for processing common configuration and media files in IIoT devices: xmllint, mp3gain, imagemagick, tiffsplit, and jpegtran. Deploy the corresponding sandbox environment, and install and instrument these target programs within it. S12: Deploy fuzzy test benchmarks corresponding to the fuzzy test target programs related to the core functional components of the Industrial Internet in S11: Deploy fuzzy test benchmarks related to 8 core functional components of the Industrial Internet, and construct test benchmarks for the above eight target programs. For example, the test benchmarks for nm, readelf, and objdump accept ELF format firmware files from real IIoT devices as initial seed input; S13: Obtain a detailed description of each fuzz test and perform instrumentation, compilation, and runtime analysis using the benchmark fuzz tester AFL: Based on the README.md document of the fuzz test program and the functional introduction documents of the relevant industrial internet core functional components, provide a detailed description of each fuzz test and provide instrumentation, compilation, and runtime analysis using the benchmark fuzz tester AFL. S14: Use the benchmark fuzz tester AFL to perform fuzz testing on the core functional components of the Industrial Internet and collect the valid mutations output during the testing process; S15: Structure the operational instructions for guiding mutations during fuzzing, the test case sequence for fuzzing, and the generated feasible mutation strategies to form a supervised training triplet. Also, structure the data generated during fuzzing of core functional components of the Industrial Internet to organize test cases. Effective mutation location Corresponding mutation strategy ,composition Supervised training for the triplet; S16: Supervised training based on the output of S15 constructs the corresponding instruction corpus for the triples. : in, Indicates the first Instructions in the training data tuples. Indicates the first For the test cases used for fuzz testing in the training data tuples, express For the effective mutation set in the training data tuples, Indicate the size of the training data and the instruction corpus. This serves as a historical fuzzy test dataset for functional components of the Industrial Internet. This represents the test cases used for fuzz testing. Represents the set of valid mutations, determined by the mutation location. and corresponding mutation strategies composition, For the program The size of the training data, To generate instructions, these are integrated into a historical fuzzy test dataset of all industrial internet functional components. ; S17: Randomly select 90% of the sample data from the historical fuzzy test dataset of industrial internet functional components as the training set and 10% of the sample data as the validation set.
[0018] S2 includes the following steps: S21: Accept the historical fuzzy test training dataset of industrial internet functional components from S17, take the byte sequence as input, and the mutation position and mutation strategy as output to build two training frameworks; S22: Construct a supervised fine-tuning model by combining prompt word engineering with LLM API and historical fuzzy test training dataset of industrial internet functional components; S23: Encapsulate the fine-tuning model as a RESTful API service.
[0019] The training framework in S21 includes an encoder-decoder framework and a decoder-only framework. This example prioritizes the autoregressive decoder-only framework as the core model architecture. This framework is responsible for modeling the entire task, including the input byte sequence, the mutation position with prediction, and the policy, as a unified sequence-to-sequence mapping problem. The two training frameworks are parallel and the choice can be made based on the number of interaction context tokens. If the number of tokens is higher than a certain threshold, the decoder-only framework can be used; otherwise, the former is used. Given source input = and target prediction = The specific expression of the encoder in the encoder-decoder framework is as follows: in, This indicates that the outputs of group A's attention head will be concatenated. This indicates that attention should be paid to the number of heads. Indicates the first One thing to note: Indicates the Softmax function, superscript Indicates transpose. Represents the self-attention function. This represents the input to the entire self-attention layer. This represents a bidirectional encoder mask matrix. , , , These represent the query matrix, key matrix, value matrix, and scaling factor, respectively. The final output of the encoder-decoder framework is a context-aware representation sequence. This indicates element-wise multiplication, where the decoder generates the target token based on the encoder's output order, serving as the mutation location and mutation strategy with prediction. Given a cascaded source-target pair The decoder framework directly maps the input to the prediction sequence, as shown in the following expression: in, This represents a bidirectional encoder mask matrix with a random mask. Represents the self-attention function. This indicates the final output of the decoder framework, where the decoder generates the target token based on the attention coefficients of the hidden state, serving as the mutation location and mutation strategy with prediction.
[0020] S22 includes the following steps: S22.1: The prompts include a task description, mutation operation, input sequence definition, output sequence definition, and input sequence template. The task description includes vulnerability mining for common ELF and specific binary formats in industrial internet protocols or device firmware. The mutation operation includes mutation strategies for common vulnerability types in IIoT / IoT devices (such as buffer overflow, command injection, and parsing logic defects). These steps sequentially clarify the functional objectives that the model needs to achieve, define the operational behaviors that the model should learn, describe the characteristics and syntax of the input data, specify the content format that the model output should present, and design a unified input sample template to standardize the model calling format t. S22.2: Based on the input sequence template, the data is organized into JSON structured data. The samples in the historical fuzzy test dataset are normalized according to the template through the script. The LLM API is called in a loop to pass the structured input data into the model, obtain the model output in real time, parse and format the returned content, extract the preset output fields, and record the results to form fine-tuning sample pairs. The input sequence template is organized into JSON structured data. The samples in the original historical fuzzy test dataset are normalized according to the template through the script. The input sequence template contains byte sequence examples from real communication traffic or firmware images of IIoT / IoT devices to form a high-quality training sample set. The LLMAPI is called in a loop to pass the structured input data into the model, obtain the model output in real time, parse and format the returned content, extract the defined output fields, and record the results to form fine-tuning sample pairs. S22.3: Fine-tune the pre-trained large model for guiding fuzzing mutations of industrial internet functional components using the collected IIoT target program dataset. The evaluation criteria are directly linked to the IIoT vulnerability mining efficiency. The model's performance in semantic accuracy, mutation rationality, and task fitness is evaluated based on the output content. Low-rank adaptive technology is adopted to maintain the core knowledge of the pre-trained model while using the training set constructed in S17 to perform a small number of iterative updates on the model weights. During the fine-tuning process, the model's performance on key indicators is continuously monitored through the validation set. Specific indicators include semantic accuracy, mutation rationality, and task fitness. The model checkpoint with the best overall performance on the validation set is selected, and its weights are solidified into a deployable version for deployment in the next stage.
[0021] S3 includes the following steps: S31: Select input files known to trigger exceptions and override specific code paths from the publicly available vulnerability database to form the initial seed pool: For industrial IoT or IoT target programs such as protocol parsing libraries and device firmware, use tools such as containers, virtual machines, and sandboxes that support the operation of industrial internet functional components to achieve environment encapsulation and isolation. Use a method based on historical vulnerability sample extraction to build initial test cases. Collect input files that are known to trigger exceptions and cover specific code paths from public IIoT / IoT vulnerability databases or the fuzzing history of the program itself to form the initial seed pool (referring to the content and expected set, initial test case one). S32: Send the test cases generated during the fuzz testing of industrial internet functional components to the fine-tuning large model for byte-type mutation, obtain the mutation suggestions composed of mutation positions and mutation strategies, and use a Top-k sampling strategy to select the top k most effective mutation schemes that cover the generated suggestions. The specific supervised fine-tuning objectives are as follows: in, It is from the first data set collected. One original input, For the predicted mutation location, As a mutation strategy, based on The value and the definition of the byte mutation strategy determine the mutation location and mutation strategy with the highest probability. This represents the dataset used for training. S33: A fuzz tester for functional components of the Industrial Internet, which receives a list of mutation locations predicted by the model. and a list of corresponding mutation strategies Then, the operations defined by the strategy will be executed sequentially on the bytes at the specified positions in the test cases. After the mutation is completed, the generated new test cases will be executed in the target program. Based on the test feedback, the mutated test cases will be marked to obtain labeled data pairs, which will serve as a feedback sequence. in, These represent the first 1 to k mutation positions obtained using the Top-k sampling strategy. These represent the first 1 to k mutation strategies obtained by using the Top-k sampling strategy; S34: Collect the labeled data pairs generated in S33 to form an incremental dataset. Use the incremental dataset periodically to incrementally fine-tune the deployed fine-tuning model: Collect the labeled (input sequence, mutation location, mutation strategy, result) data pairs generated by the fuzzer used for fuzz testing of industrial internet functional components in step S33 to form an incremental dataset. Use this dataset periodically to incrementally fine-tune the deployed fine-tuning model, enabling the model to learn from the latest test feedback, dynamically adjust its prediction strategy, and tend to generate mutations that are more likely to discover new vulnerabilities or cover new paths, thereby achieving continuous self-optimization of the testing process.
[0022] Although embodiments of the invention have been shown and described, it will be understood by those skilled in the art that various changes, modifications, substitutions and alterations can be made to these embodiments without departing from the principles and spirit of the invention, the scope of which is defined by the appended claims and their equivalents.
Claims
1. A byte-level fuzzing method based on a large language model, characterized in that: Includes the following steps: S1: Construct a standard fuzzy testing benchmark for the file format of core functional components of the Industrial Internet and collect and organize historical fuzzy testing data to build model training and validation sets; S2: Based on the data in S1, the data is taken as a byte sequence as input and the mutation position and mutation strategy as output. The training framework is used to construct the input and output into a unified sequence learning task. The dataset is then supervised and fine-tuned using cueing engineering and LLM API to complete the model training and obtain the fine-tuned model. S3: Based on the fine-tuned model after training, perform byte-type mutations, combine with a feedback sequence update mutation strategy, and continuously iterate and self-optimize fuzz testing.
2. The byte-level fuzz testing method based on a large language model according to claim 1, characterized in that: S1 includes the following steps: S11: Obtain the fuzzy test target program based on the core functional components of the Industrial Internet; S12: Deploy the fuzz test benchmark corresponding to the fuzz test target program related to the core functional components of the Industrial Internet in S11; S13: Obtain a detailed description of each fuzz test and run instrumentation compilation and runtime analysis using the benchmark fuzz tester AFL; S14: Use the benchmark fuzz tester AFL to perform fuzz testing on the core functional components of the Industrial Internet and collect the valid mutations output during the testing process; S15: The operational instructions for guiding mutations during the fuzzing process, the test case sequence for fuzzing, and the generated effective mutation strategy data are structured and processed to form a supervised training pair triplet; S16: Supervised training based on the output of S15 constructs the corresponding instruction corpus for the triples. : in, Indicates the first Instructions in the training data tuples. Indicates the first For the test cases used for fuzz testing in the training data tuples, express For the effective mutation set in the training data tuples, Indicate the size of the training data and the instruction corpus. As a historical fuzzy test dataset for functional components of the Industrial Internet; S17: Randomly select 90% of the sample data from the historical fuzzy test dataset of industrial internet functional components as the training set and 10% of the sample data as the validation set.
3. The byte-level fuzzy testing method based on a large language model according to claim 2, characterized in that: S2 includes the following steps: S21: Accept the historical fuzzy test training dataset of industrial internet functional components from S17, take the byte sequence as input, and the mutation position and mutation strategy as output to build two training frameworks; S22: Construct a supervised fine-tuning model by combining prompt word engineering with LLM API and historical fuzzy test training dataset of industrial internet functional components; S23: Encapsulate the fine-tuning model as a RESTful API service.
4. The byte-level fuzz testing method based on a large language model according to claim 3, characterized in that: The training framework in S21 includes an encoder-decoder framework and a decoder-only framework; The specific expression of the encoder in the encoder-decoder framework is as follows: in, This indicates that the outputs of group A's attention head will be concatenated. This indicates that attention should be paid to the number of heads. Indicates the first One thing to note: Indicates the Softmax function, superscript Indicates transpose. Represents the self-attention function. This represents the input to the entire self-attention layer. This represents a bidirectional encoder mask matrix. , , , These represent the query matrix, key matrix, value matrix, and scaling factor, respectively. The final output of the encoder-decoder framework is a context-aware representation sequence. This indicates element-wise multiplication. In the encoder-decoder framework, the decoder generates the target token based on the output order of the encoder, serving as the mutation position and mutation strategy with prediction. The decoder-only framework directly maps the input to the prediction sequence, as shown in the following expression: in, This represents a bidirectional encoder mask matrix with a random mask. Represents the self-attention function. This indicates the final output of the decoder framework, where the decoder generates the target token based on the attention coefficients of the hidden state, serving as the mutation location and mutation strategy with prediction.
5. The byte-level fuzz testing method based on a large language model according to claim 3, characterized in that: S22 includes the following steps: S22.1: Set the prompt words, including task description, mutation operation, input sequence definition, output sequence definition, and input sequence template; S22.2: Based on the input sequence template, the data is organized into JSON structured data. The samples in the historical fuzzy test dataset are normalized according to the template through the script. The LLM API is called in a loop to pass the structured input data into the supervised fine-tuning LLM model. The model output is obtained in real time, the returned content is parsed and formatted, the preset output fields are extracted, and the results are recorded to form fine-tuning sample pairs.
6. The byte-level fuzz testing method based on a large language model according to claim 1, characterized in that: S3 includes the following steps: S31: Select input files known to trigger exceptions and cover specific code paths from the publicly available vulnerability database to form the initial seed pool; S32: Send the test cases generated during the fuzz testing of the industrial internet functional components to the fine-tuning large model for byte-type mutation, obtain the mutation suggestions consisting of mutation positions and mutation strategies, and select the top k mutation positions and corresponding mutation strategies based on the probability of the mutation suggestions using a Top-k sampling strategy. S33: Receive the list of mutation locations predicted by the model. and a list of corresponding mutation strategies Then, the operations defined by the strategy will be executed sequentially on the bytes at the specified positions in the test cases. After the mutation is completed, the generated new test cases will be executed in the target program. Based on the test feedback, the mutated test cases will be marked to obtain labeled data pairs, which will serve as a feedback sequence. in, These represent the first 1 to k mutation positions obtained using the Top-k sampling strategy. These represent the first 1 to k mutation strategies obtained by using the Top-k sampling strategy; S34: Collect the labeled data pairs generated in S33 to form an incremental dataset, and use the incremental dataset periodically to incrementally fine-tune the deployed fine-tuning model.