HTTP protocol differential fuzz testing method and system based on large language model

Abstract

This invention belongs to the field of network security and software testing technology, and provides a method and system for HTTP protocol differential fuzzing testing based on a large language model. The technical solution reads and preprocesses RFC specification documents. Based on constructed prompts, it guides the large language model to extract HTTP request templates and HTTP field dependencies from the preprocessed RFC specification documents. Based on the acquired malicious payload and the extracted HTTP request template, it guides the large language model to generate initial test cases. The extracted HTTP field dependencies are used to mutate the initial test cases, and the mutated test cases are concurrently sent to multiple different HTTP servers to perform differential fuzzing and obtain differential fuzzing response results. The responses from all servers are received, and the differential fuzzing response results are analyzed in conjunction with the large language model to obtain differential response analysis results and generate new test cases. This solves the problems of low semantic quality of test cases and blind mutation strategies in traditional HTTP fuzzing.

Images