A method for testing a communication protocol of a drone and a computer device

Abstract

This invention discloses a fuzz testing method and computer device for unmanned aerial vehicle (UAV) communication protocols. The method includes: constructing a QEMU simulation environment adapted to the target UAV firmware; segmenting a continuous instruction sequence into basic blocks; inputting an initial protocol seed set as raw input into the QEMU simulation environment, identifying uncovered branches, and generating new samples capable of reversing the logic of those branches; scoring the quality of sample generation using a multi-dimensional reward function, enabling a large language model to generate seed samples that conform to the protocol syntax and reach the target branch; performing mutation if a new path is found within a preset time window, otherwise generating new samples using a large language model trained with reinforcement learning and adding them to the sample queue; tracking the execution process of the UAV process, collecting basic block coverage, and executing iteratively until a preset test duration or target coverage is reached. This invention can improve the efficiency and coverage accuracy of vulnerability discovery for unknown UAV communication protocols.

Description

Technical Field

[0001] This invention belongs to the field of UAV safety testing and fuzz testing technology, specifically relating to a fuzz testing method for UAV communication protocols, computer equipment, computer-readable storage media, and computer program products. Background Technology

[0002] The rapid popularization of drone technology has led to its widespread application in consumer, industrial, and security fields. As the core carrier of flight control and data transmission, the security of its communication protocol directly determines the operational safety and data privacy of drones. However, to protect technological barriers, most drone manufacturers have not disclosed the details of their communication protocols, resulting in a large number of non-standard and proprietary protocols becoming blind spots for security testing. Fuzz testing is a core technology for discovering vulnerabilities in drone communication protocols. As existing technology, Chinese patent application CN109977681A discloses a fuzz testing method and system for drones, with the specific technical solution as follows: First, initial messages conforming to the protocol specifications are randomly selected from a typical message library, and multiple rounds of random mutation operations are performed using a preset mutation number threshold. Then, the mutated messages are filtered according to the configured length limit, and the key fields such as length, sequence number and verification are modified for messages that pass the verification. This ensures that the final test message conforms to the protocol format requirements before being sent to the target drone, thereby achieving safe testing of the drone system while ensuring protocol compliance.

[0003] The existing technology has the following core defects: First, it has weak adaptability to private communication protocols of drones, relying on pre-built message libraries and conforming to known specifications. For unknown drone protocols without public documentation or typical message samples, it is impossible to build a message library. Even if there are a few message samples, due to the lack of parsing ability for protocol frame structure and field constraints, it can only perform surface-level random mutations on the messages and cannot reach the deep logic of the unknown protocol, resulting in extremely narrow test coverage. Second, the test environment has poor security and high cost. Direct testing on real drones may lead to drone loss of control or crashes, posing physical safety risks. In addition, hardware failures of real drones are costly, and failure scenarios are difficult to reproduce, which is not conducive to vulnerability localization. Third, the blind random mutation strategy leads to low test efficiency. The mutation strategy of the existing technology is "randomly select mutation methods + fixed number of thresholds", without feedback mechanism for optimization. A large number of iterations are in a state of repetitive ineffectiveness, resulting in low efficiency. Fourth, there is no code coverage collection. The monitoring module of the existing technology can only detect whether the software is "abnormal" and cannot collect code coverage, resulting in a large number of vulnerabilities being missed and the integrity of the test cannot be guaranteed. Summary of the Invention

[0004] The purpose of this invention is to provide a method for fuzz testing of UAV communication protocols, a computer device, a computer-readable storage medium, and a computer program product, which can improve the efficiency and coverage accuracy of vulnerability discovery for unknown UAV communication protocols.

[0005] To achieve the above objectives, one aspect of the present invention provides a method for fuzz testing of unmanned aerial vehicle (UAV) communication protocols, comprising: Step S1: Build a QEMU simulation environment adapted to the target drone firmware and migrate the drone firmware to the QEMU simulation environment. Step S2: Cut the continuous instruction sequence of the UAV firmware into basic blocks, traverse the jump reference relationship between basic blocks, and establish a hash mapping table from virtual memory address to basic block index; Step S3: The initial protocol seed set is used as the original input and input into the QEMU simulation environment. The covered paths are parsed by combining the hash mapping table, the uncovered branches are identified, and a new sample that can reverse the logic of the branch is generated using the large language model to construct the dataset. Step S4: Reinforcement learning training is performed on the large language model, and a multi-dimensional reward function is used to score the quality of sample generation, so that the large language model can generate seed samples that conform to the target UAV firmware protocol syntax and can reach the target's uncovered branches. Step S5: Load the initial protocol seed set and the constructed dataset into the sample queue, perform fuzz testing, and monitor the basic block coverage in real time; Step S6: If a new path is found within the preset time window, mutation is performed to generate mutation samples; otherwise, the historical execution trajectory corresponding to the boundary basic block in the current coverage bitmap is used as input, and a new sample is generated using a large language model trained by reinforcement learning and added to the sample queue. Step S7: Read the test sample from the sample queue and write it into the target drone process. Track the execution process of the drone process, collect the basic block coverage of this execution, update the coverage bitmap, and return to step S6 to execute repeatedly until the preset test duration or target coverage is reached.

[0006] Another aspect of the present invention provides a computer device including a memory, a processor, and a computer program stored in the memory, wherein the processor executes the computer program to implement the steps of the method described above.

[0007] Another aspect of the present invention provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of the method described above.

[0008] Another aspect of the present invention provides a computer program product including a computer program that, when executed by a processor, implements the steps of the method described above.

[0009] The fuzz testing method, computer equipment, computer-readable storage medium, and computer program product for UAV communication protocols according to the above-described aspects of the present invention can improve the efficiency and coverage accuracy of unknown protocol vulnerability discovery and are applicable to security detection and vulnerability discovery of unknown UAV communication protocols. Attached Figure Description

[0010] To more clearly illustrate the technical solutions of the present invention, the accompanying drawings used in the description of the embodiments of the present invention will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort: Figure 1 This is a flowchart of a fuzzy testing method for a drone communication protocol according to an embodiment of the present invention; Figure 2 This is a schematic diagram of a fuzzy testing method for a drone communication protocol according to an embodiment of the present invention; Figure 3 This is a structural diagram of a computer device according to an embodiment of the present invention. Detailed Implementation

[0011] To make the objectives, technical solutions, and advantages of this invention clearer, the technical solutions of this invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this invention, and not all embodiments. Based on the embodiments of this invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this invention.

[0012] One embodiment of the present invention provides a fuzz testing method for unmanned aerial vehicle (UAV) communication protocols. The method of this embodiment is logically divided into three stages: simulation environment and benchmark construction, intelligent generation strategy construction and optimization, and multi-process collaborative adaptive fuzz testing. The following is combined with… Figure 1 Flowcharts and Figure 2 The schematic diagram illustrates the method of the embodiment of the present invention in detail. Phase 1: Simulation Environment and Benchmark Construction (Steps S1-S2) S1: Build a QEMU (open-source virtualization tool) emulation environment adapted to the target firmware, including the following steps: S11 Booting and Memory Adaptation: Parse the binary header information of the target drone firmware, extract boot information such as bootloader type, kernel startup parameters, memory layout mapping and exception vector table entry address, and write a hardware configuration file suitable for QEMU.

[0013] S12 Peripheral Behavior Modeling: For dedicated peripherals (such as flight control sensors and dedicated communication modules) that are essential for the operation of UAV firmware, QEMU peripheral simulation scripts are written by analyzing their I / O interaction logs to build a "virtual peripheral model" to respond to the hardware interrupt requests of the firmware and prevent the firmware from getting stuck in an infinite loop or having limited functionality due to the lack of peripherals.

[0014] S13 Environment Migration Verification: Based on steps S11 and S12, develop a QEMU peripheral simulation module adapted to the specific CPU architecture of the drone firmware, and compile and integrate it into the qemu-system simulator; load and start the target drone firmware to complete the migration from physical hardware to the virtualized environment.

[0015] In this step, QEMU snapshot technology is used to save the initial running state of the UAV firmware and the simulation environment configuration. When the environment needs to be reset during the simulation, the snapshot is loaded to achieve a fast state rollback, thereby improving the continuity and efficiency of the simulation process.

[0016] S2: Construct the firmware static control flow graph, including the following steps: S21: Load the binary image of the target drone firmware, identify instruction boundaries through the disassembler engine, and cut the continuous instruction sequence into basic blocks using conditional jump instructions (such as jz, bnz), unconditional jump instructions (jmp), function call instructions (call), and function return instructions (ret) as terminators. These blocks will serve as the unit of measurement for subsequent code coverage statistics.

[0017] S22: Traverse the jump reference relationships between basic blocks, construct a global static control flow graph (CFG), and establish "virtual memory addresses". The hash map of the "basic block index ID". The hash map generated in this step will serve as the sole index for Intel-PT (Processor Trace) dynamic data decoding and coverage calculation in the subsequent S8 step.

[0018] Phase 2: Construction and optimization of intelligent seed generation strategy (steps S3-S4) S3: Construct a branch-guided fine-tuning dataset based on trajectory reversal, including the following steps: S31: Prepare the initial protocol seed set. This seed set is obtained from packet capture of the actual communication link of the target UAV. Without knowing the specific protocol definition, it is used as the raw input to the QEMU simulation environment.

[0019] S32: Use Intel-PT technology to collect the dynamic execution trajectory corresponding to each seed, combine it with the mapping table in step S22 to parse out the "covered path", analyze the conditional jump instruction at the end of the trajectory, and identify the branch direction that has not been triggered.

[0020] S33: Extract the preceding code trajectory and original input data leading to the uncovered branch. Construct a structured Prompt input containing features of the uncovered branch, the preceding code trajectory, and UAV communication protocol format constraints, and feed it into the LLM (Large Language Model). Due to the unknown protocol format, utilize the code understanding capability of the Large Language Model to analyze the constraints of the preceding instructions on the input data, and inversely infer the protocol field structure and numerical features required to trigger the uncovered branch, generating a new sample that can reverse the logic of this branch. Collect the new inputs generated by the LLM to construct a high-quality, content-rich dataset for subsequent model training and optimization.

[0021] Step S4: Policy network optimization based on generative reinforcement learning, including the following steps: S41: Initialize the LLM to be trained as a policy network and build a reinforcement learning environment that includes simulator feedback.

[0022] S42: Employing the GRPO (Guided Reward Policy Optimization) algorithm improved in this invention for UAV firmware fuzzy testing scenarios, the LLM generates parallel fuzzy trajectories for the same input trajectory. Candidate variant samples .

[0023] S43: Inject candidate samples in batches into the simulation environment and design a multidimensional reward function. The quality of the generated samples is scored. Formula definition:

[0024] Parameter description: : Represents the old execution path corresponding to the original input; : Represents the new execution path corresponding to the new input generated by LLM; : Confidence score output by LLM, range of values ; : Protocol format validity reward (0 or 1), used to constrain the syntactic correctness of the generated data; The reward is the reciprocal of the distance between the end of the new path and the target uncovered basic block; the closer the distance, the higher the reward. The overlap between new and old paths is penalized to encourage the exploration of differentiated paths.

[0025] : These are the weighting coefficients for the above items, used to balance the importance of protocol compliance, exploration depth, differentiation, and model confidence.

[0026] S44: Calculate the reward value Substitute the GRPO reinforcement learning objective function and update the LLM parameters through backpropagation until it converges to generate seed samples that "conform to the implicit protocol syntax of the target firmware and can reach deep target branches".

[0027] Phase 3: Adaptive Fuzz Testing with Multi-Process Collaboration (Steps S5-S7) Step S5: Initialize the multi-process co-simulation environment and execute hybrid strategy sample generation, including the following steps: S51: Starts the Fuzzer (fuzzy logic controller) process, the LLM inference process, and the QEMU simulation process. Requests shared memory as an inter-process data channel.

[0028] S52: Load the initial protocol seed set described in step S31 and the high-quality dataset constructed in step S33 into the Fuzzer sample queue.

[0029] S53: Load the UAV firmware snapshot debugged in step S13 into QEMU, restore the CPU register state and memory context, complete the communication handshake between the Agent in the Guest OS (the Guest environment emulated by QEMU) and the host Fuzzer process, and establish a consistent test benchmark environment.

[0030] S6: Execute hybrid strategy sample generation S61: The Fuzzer process monitors the growth curve of global code coverage in real time.

[0031] S62: If a new path is found within a preset time window (e.g., 5 minutes), the traditional mutation mode is executed (including random field flipping, packet splicing / truncation, protocol field boundary value mutation, etc.); if no new path is found within the set time, it is determined that it is trapped in a local optimum and automatically switches to the intelligent generation mode.

[0032] S63: In Smart Mode, retrieve the boundary basic blocks (i.e., the end nodes of covered paths and the adjacent nodes of untriggered basic blocks to be covered) in the current coverage Bitmap, serialize their corresponding historical execution trajectories into Prompts, and send them to the LLM inference process. Based on the strategy optimized in step S4, LLM dynamically cracks and completes the check bits, length fields, or specific Magic Numbers in the unknown protocol, generating targeted new samples and writing them into shared memory.

[0033] Step S7: Cross-level sample injection and execution-driven processing, including Intel-PT code tracing, coverage feedback, and anomaly capture, and environment reset based on virtual machine snapshots, comprising the following steps: S71: The QEMU process reads the test sample from shared memory and passes it through the simulated device interface to the Guest.

[0034] S72: The Agent inside the Guest takes over the data packet and writes it into the protocol parsing entry point (such as the recv buffer) of the target drone process, triggering the parsing logic of the target program; S73: During the execution of the target program, the host CPU enables the Intel-PT hardware tracing function to capture control flow change packets in real time. This process does not consume CPU cycles of the QEMU virtual machine.

[0035] S74: The QEMU process reads the PT data stream in real time, decodes it using the hash mapping table constructed in step S22, and restores the compressed hardware stream to the basic block ID sequence.

[0036] S75: The QEMU process calculates the basic block coverage of this execution, updates the global shared Bitmap, and reports it back to the Fuzzer process.

[0037] S76: Monitor the running status of the QEMU virtual machine and monitor whether there are abnormal responses during the execution of the target drone process. If a crash is detected, such as a Segmentation Fault, the current sample is immediately saved to the vulnerability log. If the Fuzzer process determines that the sample triggers an unrecorded basic block combination path based on the globally shared Bitmap, it marks it as a high-value sample and adds it to the sample queue.

[0038] S77: After a single test cycle ends, QEMU triggers the memory snapshot recovery mechanism, discards the dirty pages generated during this execution, and instantly rolls back the virtual machine state to the initial snapshot point defined in step S53.

[0039] S78: Send a ready signal to the Fuzzer process, return to step S6 and repeat until the preset test duration or target coverage is reached.

[0040] In summary, the UAV communication protocol fuzzing method of this invention addresses the problems encountered in existing UAV unknown protocol fuzzing processes, such as difficulty in adapting unknown protocols, poor simulation security, low test case efficiency, and insufficient coverage monitoring. It proposes a method that integrates LLM unknown protocol modeling, QEMU UAV firmware simulation, and Intel... The PT code coverage acquisition and reinforcement learning-optimized fuzzing technology for UAV communication protocols includes: QEMU+Intel-PT UAV firmware simulation technology: achieving closed-source firmware simulation through boot information adaptation and customized peripheral modeling, combined with snapshot rollback to improve testing efficiency, solve the risk of runaway in real testing, and reduce hardware costs; Intel-PT-based code trajectory extraction method in source-code-less scenarios: dividing basic blocks through Intel-PT parsing and binary disassembly, mapping dynamic instruction addresses to static basic blocks through the longest common prefix algorithm to generate execution trajectory sequences, solving the coverage acquisition problem of instrumentation in source-code-less firmware; a multi-dimensional coverage distance reward mechanism for UAV protocols: introducing "key node coverage" and "path simplification" (penalizing redundant paths), quantifying rewards through a weighted formula, making reinforcement learning and large language model optimization more suitable for the execution logic of UAV firmware, and improving the success rate of branch triggering; and an LLM-driven closed-loop scheduling mechanism for UAV protocol fuzzing: shared memory communication and high-value seed / branch priority scheduling, achieving complementary advantages between LLM-generated input and traditional mutation, differentiating itself from the random scheduling mode of general fuzzing, and solving the problem of insufficient coverage.

[0041] The fuzzy testing method for UAV communication protocols in this embodiment of the invention has the following beneficial effects: 1. This invention addresses the problem of relying on manual reverse engineering or pre-set sample libraries for modeling unknown UAV protocols. By automatically modeling UAV private communication protocols based on LLM, it achieves automated parsing of protocol frame structure, field constraints, and interaction timing, eliminating the dependence on known protocol samples and realizing automatic modeling and parsing of unknown UAV protocols. It is suitable for scenarios involving vendor-owned protocols and non-standard protocols without public documentation.

[0042] 2. This invention addresses the physical security risks and high hardware costs associated with real-world drone testing. By using customized QEMU-based drone firmware simulation, integrating dedicated drone peripheral models and Intel PT coverage data acquisition, it avoids the risks of loss of control and crashes in real-world drone testing, reduces hardware failure repair costs, and enables accurate reproduction and tracing of fault scenarios. Furthermore, through rapid firmware state rollback and accurate execution trajectory acquisition, it provides reliable support for vulnerability reproduction and analysis.

[0043] 3. This invention addresses the problem of high invalid test cases and low vulnerability discovery efficiency caused by traditional random mutation. By combining reinforcement learning optimization strategies of code coverage and anomaly response, the direction and probability of mutation are dynamically adjusted according to the importance of protocol fields and test feedback. This improves the coverage of high-risk paths and the efficiency of vulnerability triggering, reduces redundant test iterations, and enables large language models to generate efficient test cases that target uncovered branches. This reduces the proportion of invalid test cases from traditional random mutation and improves vulnerability discovery efficiency.

[0044] 4. This invention addresses the problem that it can only detect surface anomalies in software and cannot assess the completeness of testing. By using a precise code coverage acquisition mechanism based on QEMU and Intel PT, it achieves real-time monitoring of basic block coverage and marking of high-risk code paths, providing quantitative basis for test iteration and vulnerability omission risk assessment.

[0045] 5. This invention addresses the problem of insufficient coverage monitoring by using closed-loop fuzzy testing based on LLM and QEMU collaboration. Through code coverage feedback and priority queue scheduling, it continuously explores uncovered code regions, significantly improving code coverage and vulnerability discovery accuracy. This provides a complete and efficient technical means for the security assessment and vulnerability remediation of UAV firmware.

[0046] Embodiments of the present invention also provide a computer device, which may be a server, and its internal structure diagram may be as follows: Figure 3 As shown. The computer device includes a processor, memory, and a network interface connected via a system bus. The processor provides computing and control capabilities. The memory includes a non-volatile storage medium and internal memory. The non-volatile storage medium stores an operating system, computer programs, and a database. The internal memory provides an environment for the operation of the operating system and computer programs in the non-volatile storage medium. The database stores operating parameter data for various components. The network interface communicates with external terminals via a network connection. When executed by the processor, the computer program implements the steps of the method according to embodiments of the present invention.

[0047] Those skilled in the art will understand that Figure 3 The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device to which the present application is applied. Specific computer devices may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0048] Embodiments of the present invention also provide a computer-readable storage medium having a computer program stored thereon, wherein the computer program, when executed by a processor, implements the steps of the method of the embodiments of the present invention.

[0049] Embodiments of the present invention also provide a computer program product, including a computer program that, when executed by a processor, implements the steps of the method of the embodiments of the present invention.

[0050] The foregoing has only described certain exemplary embodiments of the present invention by way of illustration. Undoubtedly, those skilled in the art can modify the described embodiments in various ways without departing from the spirit and scope of the present invention. Therefore, the foregoing drawings and descriptions are illustrative in nature and should not be construed as limiting the scope of protection of the claims of the present invention.

Claims

1. A method for drone communication protocol fuzzing, the method comprising: include: Step S1: Build a QEMU simulation environment adapted to the target drone firmware and migrate the drone firmware to the QEMU simulation environment. Step S2: Cut the continuous instruction sequence of the UAV firmware into basic blocks, traverse the jump reference relationship between basic blocks, and establish a hash mapping table from virtual memory address to basic block index; Step S3: The initial protocol seed set is used as the original input and input into the QEMU simulation environment. The covered paths are parsed by combining the hash mapping table, the uncovered branches are identified, and a new sample that can reverse the logic of the branch is generated using the large language model to construct the dataset. Step S4: Reinforcement learning training is performed on the large language model, and a multi-dimensional reward function is used to score the quality of sample generation, so that the large language model can generate seed samples that conform to the target UAV firmware protocol syntax and can reach the target's uncovered branches. Step S5: Load the initial protocol seed set and the constructed dataset into the sample queue, perform fuzz testing, and monitor the basic block coverage in real time; Step S6: If a new path is found within the preset time window, mutation is performed to generate mutation samples; otherwise, the historical execution trajectory corresponding to the boundary basic block in the current coverage bitmap is used as input, and a new sample is generated using a large language model trained by reinforcement learning and added to the sample queue. Step S7: Read the test sample from the sample queue and write it into the target drone process. Track the execution process of the drone process, collect the basic block coverage of this execution, update the coverage bitmap, and return to step S6 to execute repeatedly until the preset test duration or target coverage is reached.

2. The method as described in claim 1, characterized in that, Step S1 includes: Analyze the binary header information of the target drone firmware to extract the boot information; A virtual peripheral model is constructed by analyzing the interaction behavior between the drone firmware and peripheral devices. Develop a QEMU peripheral simulation module based on the boot information and virtual peripheral model, and compile and integrate it into the QEMU simulator to migrate the UAV firmware to the QEMU simulation environment.

3. The method as described in claim 1 or 2, characterized in that, Step S2 includes: Load the binary image of the target drone firmware, identify instruction boundaries through the disassembler engine, and cut the continuous instruction sequence into basic blocks using conditional jump instructions, unconditional jump instructions, function call instructions, and function return instructions as terminators; Traverse the jump reference relationships between basic blocks, construct a global static control flow graph, and establish a hash mapping table from virtual memory addresses to basic block indices.

4. The method as described in claim 1 or 2, characterized in that, Step S3 includes: Prepare an initial protocol seed set and use it as the raw input to input the QEMU simulation environment; Collect the dynamic execution trajectory corresponding to each seed, parse the covered path by combining the hash mapping table, analyze the conditional jump instruction at the end of the trajectory, and identify the branch direction that has not been triggered. Extract the preceding code trajectory and original input data leading to the untriggered branch. Input the untriggered branch features, preceding code trajectory, and UAV communication protocol format constraints into the large language model. Inversely infer the protocol field structure and numerical features required to trigger the untriggered branch, and generate a new sample that can reverse the logic of the branch.

5. The method as described in claim 1 or 2, characterized in that, Step S4 includes: Enables large language models to generate in parallel for the same input trajectory candidate samples ; Candidate samples are injected into the simulation environment in batches, and a multi-dimensional reward function is designed to score the quality of sample generation and calculate the reward value. The calculated reward value is substituted into the reinforcement learning objective function, and the parameters of the large language model are updated through backpropagation until it converges to generate seed samples that conform to the target drone firmware protocol syntax and can reach the target branch.

6. The method as described in claim 5, characterized in that, The multidimensional reward function is: ， in As a reward value, This represents the old execution path corresponding to the original input. This represents the new execution path corresponding to the new input generated by the large language model. This means the target does not cover the basic block. The confidence score represents the output of the large language model; Rewards are given for the legality of the agreement format. This is the reciprocal of the distance between the end of the new path and the target uncovered basic block. This is a penalty for the overlap between the old and new paths; These are the weighting coefficients for each item.

7. The method as described in claim 1 or 2, characterized in that, In step S1, QEMU snapshot technology is used to save the initial running state of the drone firmware and the simulation environment configuration. In step S5, the drone firmware snapshot is loaded into QEMU before the test to provide a consistent benchmark execution environment for fuzz testing. In step S8, if an abnormal response occurs during the execution of the target drone process, the current sample is saved to the vulnerability log and quickly restored to the initial state by loading the snapshot.

8. The method as described in claim 1 or 2, characterized in that, In step S6, if a new path is found within a preset time window, the traditional mutation mode is executed; if no new path is found within the preset time window, it is determined that the system is trapped in a local optimum, and the system automatically switches to the intelligent generation mode. In intelligent generation mode, the boundary basic blocks in the current coverage bitmap are retrieved, and their corresponding historical execution trajectories are serialized into a Prompt and sent to the large language model. The large language model dynamically cracks and completes the check bits, length fields or specific magic numbers in the unknown protocol, generates targeted new samples and writes them into shared memory.

9. The method as described in claim 1 or 2, characterized in that, In step S7, a multi-process collaborative fuzzing test is performed, comprising the fuzzing test process, the large language model inference process, and the QEMU simulation process, including: The QEMU process reads the test sample from shared memory and sends it to the Guest client within the virtual machine; The Agent on the Guest side writes data packets into the protocol parsing entry point of the target drone process, triggering the parsing logic of the target program; During the execution of the target program, control flow change data packets are captured in real time through hardware tracing. The QEMU process reads and tracks the data stream in real time, decodes it using a hash map, and restores the compressed hardware stream to a sequence of basic block indexes. The QEMU process calculates the basic block coverage for this execution, updates the coverage bitmap, and feeds it back to the fuzzing process. If the fuzzing process determines that a sample triggers an unrecorded basic block combination path based on the coverage bitmap, it marks it as a high-value sample and adds it to the sample queue. After a single test cycle ends, the QEMU process rolls the virtual machine state back to its initial state; Send a ready signal to the fuzzy testing process, return to step S6 to execute the large language model inference process to generate new samples, until the preset test duration or target coverage is reached.

10. A computer device, comprising a memory, a processor, and a computer program stored in the memory, characterized in that, The processor executes the computer program to implement the steps of the method according to any one of claims 1-9.

Images