A coverage-guided grey-box fuzzing method based on large language model agent cooperation

Abstract

The application discloses a coverage-guided grey-box fuzzing method based on a large language model (LLM) agent collaboration. The method first constructs a test environment composed of a fuzzer, a mutation server, a source code coverage collector, and multiple large language model agents. The mutation server provides a hot-loadable mutation strategy module to the executor through an inter-process communication channel. The source code coverage collector independently runs a source code coverage instrumentation binary to collect source code coverage when each new test case is stored. Second, during the fuzzing execution process, Thompson Sampling is used to adaptively schedule between the traditional byte mutator and the large language model mutator, and Thompson Sampling dynamically allocates mutation opportunities based on the posterior probability of new coverage generated by each mutation path. Finally, during the test iteration process, the coverage analysis agent generates an exploration direction based on the source code coverage data, the mutator writing agent generates and hot-loads new mutation strategy modules based on the exploration direction, the test case generation agent generates test cases based on the exploration direction and imports them into the executor, and each agent retains experience between iterations through a persistent memory file to improve the coverage convergence speed and vulnerability discovery capability of the fuzzing.

Description

Technical Field

[0001] This invention belongs to the field of software security testing and software vulnerability discovery technology, specifically involving a coverage-guided gray-box fuzzy testing method based on large language model intelligent agent collaboration. Background Technology

[0002] Coverage-guided fuzzing (CGF) has become a mainstream technique for automated software vulnerability discovery. It involves inserting coverage feedback instrumentation into the target under test, collecting code coverage data for each execution, and evolving the corpus accordingly. In this approach, the mutation strategy is a key factor affecting testing efficiency. Existing fuzzing frameworks typically employ a generic mutant based on a pre-defined set of byte-level operations, using the same mutation operators for all targets under test. However, for targets with complex input formats and strong field constraints, such as media decoders, file format parsers, and protocol parsers, these generic mutants struggle to efficiently generate test cases that pass the format front-end validation, leading to premature coverage convergence.

[0003] Meanwhile, mutation strategies for specific targets typically need to be manually written by security researchers, which is labor-intensive and highly dependent on experience. Existing syntax-based or model-based mutants, even those generated by large language model agents, have rules fixed before testing begins, making it difficult to adjust online based on runtime coverage feedback. Existing methods for using large language model agents to generate test inputs usually treat them as one-time input generators, lacking the ability to continuously consume coverage feedback, continuously update mutation strategies, and accumulate experience across iterations during fuzzing. To overcome these shortcomings, this invention discloses a coverage-guided gray-box fuzzing method based on large language model agent collaboration, enabling online evolution of mutation strategies and generation of test cases driven by multiple agents, thereby improving the coverage convergence speed and vulnerability discovery capabilities of fuzzing. Summary of the Invention

[0004] The purpose of this invention is to address the problems of existing coverage-guided fuzzing frameworks, which rely on manually written mutation strategies, have low testing efficiency for targets with complex input formats, and cannot continuously consume coverage feedback and accumulate experience across iterations during fuzzing. The invention aims to improve the efficiency of fuzzing for targets with complex input formats without relying on manually written target-specific mutation strategies, thereby enabling faster access to the deep code paths of the target and the discovery of security vulnerabilities to improve software security.

[0005] The coverage-guided gray-box fuzzy testing method based on large language model agent collaboration, as described in this invention, includes the following steps:

[0006] (1) Construct a test environment for performing fuzz testing on the target under test. The test environment includes a fuzzer, a mutation server, a source code coverage collector, and multiple large language model agents. The fuzzer is linked to a pre-built instrumented target program and collects code coverage information, execution time information, and abnormal termination status during the execution of test cases. The mutation server loads a dynamically replaceable mutation strategy module and provides mutation services to the fuzzer through a first inter-process communication channel. The mutation server also listens to a second inter-process communication channel independent of the first inter-process communication channel, which is used to receive hot-loading instructions for mutation strategies. For each test case that is about to be added to the fuzz test corpus and is determined to be a new coverage, the source code coverage collector uses the test case as input and executes a pre-built source code coverage instrumentation binary to collect the source code coverage file.

[0007] (2) During the fuzz test, before each mutation, the fuzz tester adaptively schedules between two mutation paths, the traditional byte mutant and the large language model mutant, based on Thompson sampling. The fuzz tester maintains a Beta distribution parameter consisting of a success count and a failure count for each mutation path. It uses the observation result of whether a new coverage is generated after each mutation as the observation result of the Bernoulli trial and updates the Beta distribution parameter of the corresponding mutation path. Before each mutation, it independently samples two random numbers from the posterior a posteriori of the Beta distribution of the two mutation paths and uses the one with the larger sample number as the mutation path used for this mutation. The traditional byte mutant performs mutation based on a preset set of byte-level operations. The large language model mutant sends the current input to the mutation server through the first inter-process communication channel and receives the byte sequence processed by the mutation strategy module.

[0008] (3) During the fuzzing process, the multiple large language model agents are coordinated and scheduled in an iterative manner. In each iteration, the coverage analysis agent first reads the source code coverage file, performs global coverage analysis on the target under test, identifies the code regions or program behaviors that have not yet been covered, and generates exploration direction text to guide subsequent mutation and test case generation. Then, the mutant writing agent generates a new mutation strategy module corresponding to the current iteration identifier based on the exploration direction text and the source code of the target under test, and notifies the mutation server to load the new mutation strategy module through the second inter-process communication channel. At the same time, the test case generation agent generates one or more test case files based on the exploration direction text and the source code of the target under test. The fuzzer is equipped with a test case injection stage. The test case injection stage traverses the test case files generated by the test case generation agent each time it is scheduled, reads the file content into the fuzzer, and performs evaluation.

[0009] Furthermore, in step (1), the code coverage information includes at least basic code block coverage information or edge coverage information; the inter-process communication channel includes sockets, shared memory, message queues, pipes and memory mapping; the source code coverage includes at least line coverage, function coverage and branch coverage.

[0010] Further, in step (2), the initial value of the Beta distribution is set to be equivalent to the uniform prior Beta distribution Beta(1,1). The step of sampling from the posterior of the Beta distribution is constructed using a Gamma distribution, specifically including sampling two random numbers from two Gamma distributions with shape parameters of success count and failure count, respectively, and normalizing the first random number with the sum of the two random numbers as the sampling result of the Beta distribution. When the sum of the two random numbers is zero, a preset value is returned as the sampling result. After each mutation is completed, the success of the mutation is determined based on whether the mutation results in the addition of new test cases to the corpus, and the Beta distribution parameters corresponding to the most recently used mutation path are updated accordingly. The preset byte-level operation set used by the traditional byte mutant includes at least one of the following:

[0011] 1) Flip a single bit at a randomly selected position in the current input;

[0012] 2) Invert the bits of a single byte randomly selected from the current input;

[0013] 3) Replace the byte at a randomly selected position in the current input with a preset 8-bit constant;

[0014] 4) Replace two consecutive bytes at a randomly selected position in the current input with a preset 16-bit constant, and randomly select big-endian or little-endian order during the replacement;

[0015] 5) Replace four consecutive bytes at a randomly selected position in the current input with a preset 32-bit constant, and randomly select big-endian or little-endian order during the replacement;

[0016] 6) Replace the byte at a randomly selected position in the current input with a pseudo-random byte;

[0017] 7) Delete consecutive bytes in the current input starting at a randomly selected position and with a randomly selected length;

[0018] 8) Insert a pseudo-random byte of random length at a randomly selected position in the current input;

[0019] 9) Copy the bytes of a randomly selected range in the current input and insert them into a randomly selected position in the current input;

[0020] 10) Overwrite the bytes of a randomly selected range in the current input with pseudo-random bytes;

[0021] 11) Swap bytes at two randomly selected positions in the current input;

[0022] 12) Randomly select another test case from the corpus queue, randomly select splicing points in the current input and the other test case respectively, and splice the byte sequence of the other test case after its splicing point to the splicing point of the current input to form a new byte sequence.

[0023] Furthermore, in step (3), after receiving the mutation strategy hot-loading instruction, the mutation server dynamically loads the new mutation strategy module path or content carried in the instruction as the mutation strategy module used by the mutation server. If an abnormality occurs during the loading process, the original mutation strategy module is retained to continue providing services.

[0024] Furthermore, in step (3), a persistent memory file is maintained for each type of large language model agent. The persistent memory file is read by the agent itself each time it is invoked and updated by the agent itself when the task is completed. The persistent memory file includes at least the structured information of the source code of the target under test, input format constraints, explored and unexplored code regions, valid and invalid exploration directions, and mutation strategy experience. In the initialization phase of the fuzzing activity, before starting the fuzzer, the agent writing agent and the test case generation agent can be invoked once or multiple times to generate the initial mutation strategy module based on the source code of the target under test and load it into the mutation server. The generated test case file is used as the seed for fuzzing. If the agent is not invoked, the mutation server loads its default mutation strategy module, and the fuzzer loads the user-provided file or a randomly generated file as the seed for fuzzing.

[0025] Compared with the prior art, the present invention has the following advantages:

[0026] (1) This invention uses Thompson sampling to dynamically allocate mutation opportunities between byte-level mutants and large language model mutants based on posterior coverage gains. Compared to existing fixed-probability scheduling schemes, this invention can allocate most mutation opportunities to the more effective mutants while retaining exploration opportunities for the weaker ones, thereby improving mutation resource utilization and coverage convergence speed.

[0027] (2) This invention utilizes the collaborative iteration of three types of large language model agents: coverage analysis, mutant writing, and test case generation. During runtime, it generates exploration directions online, hot-loads target-specific mutation strategy modules, and injects structured test cases. Compared to solutions that rely on manually written mutation strategies or offline fixed rules, this invention can continuously evolve mutations and test case generation directions based on coverage feedback without human intervention, improving testing efficiency for targets with complex input formats.

[0028] (3) This invention maintains an independent persistent memory file for each type of large language model agent, which is read and updated by the agent itself, preserving its accumulated experience in the structure of the target under test, input format constraints, and mutations across multiple iterations. Compared to schemes that use large language model agents as one-time input generators or one-time mutant writing tools, this invention enables agents to accumulate understanding of the target under test across iterations, avoids repeated analysis from scratch in each round, and improves the overall efficiency of long-cycle testing activities. Attached Figure Description

[0029] Figure 1 This is a logical framework diagram of the coverage-guided gray-box fuzzy testing method based on large language model intelligent agent collaboration introduced in this invention. Detailed Implementation

[0030] The technical solution of the present invention will be described in detail below, but the scope of protection of the present invention is not limited to the embodiments described.

[0031] Example: A coverage-guided gray-box fuzzy testing method based on large language model agent collaboration according to the present invention includes the following steps:

[0032] (1) Construct a test environment for performing fuzz testing on the target under test. The test environment includes a fuzzer, a mutation server, a source code coverage collector, and multiple large language model agents. The fuzzer is linked to a pre-built instrumented target program and collects code coverage information, execution time information, and abnormal termination status during the execution of test cases. The mutation server loads a dynamically replaceable mutation strategy module and provides mutation services to the fuzzer through a first inter-process communication channel. The mutation server also listens to a second inter-process communication channel independent of the first inter-process communication channel, which is used to receive hot-loading instructions for mutation strategies. For each test case that is about to be added to the fuzz test corpus and is determined to be a new coverage, the source code coverage collector uses the test case as input and executes a pre-built source code coverage instrumentation binary to collect the source code coverage file.

[0033] (2) During the fuzz test, before each mutation, the fuzz tester adaptively schedules between two mutation paths, the traditional byte mutant and the large language model mutant, based on Thompson sampling. The fuzz tester maintains a Beta distribution parameter consisting of a success count and a failure count for each mutation path. It uses the observation result of whether a new coverage is generated after each mutation as the observation result of the Bernoulli trial and updates the Beta distribution parameter of the corresponding mutation path. Before each mutation, it independently samples two random numbers from the posterior a posteriori of the Beta distribution of the two mutation paths and uses the one with the larger sample number as the mutation path used for this mutation. The traditional byte mutant performs mutation based on a preset set of byte-level operations. The large language model mutant sends the current input to the mutation server through the first inter-process communication channel and receives the byte sequence processed by the mutation strategy module.

[0034] (3) During the fuzzing process, the multiple large language model agents are coordinated and scheduled in an iterative manner. In each iteration, the coverage analysis agent first reads the source code coverage file, performs global coverage analysis on the target under test, identifies the code regions or program behaviors that have not yet been covered, and generates exploration direction text to guide subsequent mutation and test case generation. Then, the mutant writing agent generates a new mutation strategy module corresponding to the current iteration identifier based on the exploration direction text and the source code of the target under test, and notifies the mutation server to load the new mutation strategy module through the second inter-process communication channel. At the same time, the test case generation agent generates one or more test case files based on the exploration direction text and the source code of the target under test. The fuzzer is equipped with a test case injection stage. The test case injection stage traverses the test case files generated by the test case generation agent each time it is scheduled, reads the file content into the fuzzer, and performs evaluation.

[0035] Example 1:

[0036] The coverage-guided gray-box fuzzy testing method based on large language model agent collaboration in this embodiment includes the following steps:

[0037] I. Test Environment Setup:

[0038] First, this embodiment constructs a single-process fuzzer with automatic restart capabilities based on LibAFL. The fuzzer is compiled into a static library and linked with the test entry function of the target under test during the construction of the instrumentation binary, thereby obtaining an executable instrumentation target program. The instrumentation binary includes two types: one is an instrumentation binary using LLVM edge coverage instrumentation (SanitizerCoverage), called the edge coverage binary, used to provide edge coverage feedback to the fuzzer in the main test loop via shared memory mapping; the other is an instrumentation binary using LLVM source code-level coverage instrumentation, called the source code coverage binary, used to generate source code coverage files for agent analysis when new test cases are added to the corpus.

[0039] Secondly, regarding the mutation server, this embodiment sets up a mutation server process that communicates with the fuzzer via a Unix domain socket. The mutation server loads a mutation strategy module within its process. This mutation strategy module is a dynamically loadable module that defines a mutation entry function. The mutation entry function takes a byte sequence as input and returns a mutated byte sequence. The mutation server listens on two independent Unix domain sockets: one is a data socket, used to receive the input byte sequence from the fuzzer and return the mutated byte sequence; the other is a control socket, used to receive a hot-load instruction, which carries the file path of the new mutation strategy module. Upon receiving the hot-load instruction, the mutation server dynamically loads the target module into the process space according to the file path and replaces the currently used mutation strategy module with the newly loaded module. If an exception occurs during the loading of the new module, the original mutation strategy module is retained to continue providing services, avoiding interruption of the mutation service due to defects in the mutation strategy module itself.

[0040] Finally, regarding the source code coverage collector, this embodiment encapsulates a coverage collection corpus on top of the corpus component of the fuzz tester. When the coverage collection corpus implements the interface for adding new test cases to the corpus, it will additionally take the new test cases as input and call the source code coverage binary.

[0041] II. Adaptive Mutation Path Scheduling Based on Thompson Sampling

[0042] This embodiment sets up two mutants inside the fuzz tester: one is a traditional byte mutant based on a set of byte-level operations, whose specific mutation operators include bit flipping, byte flipping, insertion of 8-bit, 16-bit, and 32-bit constants, random replacement, byte deletion, byte insertion, byte copying, byte swapping, and byte concatenation; the other is a mutant based on a large language model, which internally maintains a long connection to the mutation server's data socket. Through this long connection, the current input byte sequence is sent to the mutation server, and the byte sequence processed by the current mutation strategy module is received as the mutation result.

[0043] To enable the fuzz tester to adaptively determine which mutant to perform each mutation based on the observed coverage feedback, this embodiment uses the Thompson sampling method to model the mutation effects of the two mutants. Specifically, each mutant is considered as the reward arm of a Bernoulli experiment, and whether a new coverage is generated after each mutation is taken as the result of a Bernoulli trial. A posterior of a Beta distribution is maintained for each mutant, and the Beta distribution parameters are determined by the success count. With failure count Composition; Initial time and All are initialized to 1, corresponding to the uniform prior Beta(1,1); after each mutation, the success of the mutation is determined by whether a new test case is added to the corpus. If successful, the corresponding mutant is... Increment by 1, otherwise the corresponding mutant Increment by 1. Before each mutation, a random number is independently sampled from the posterior of the Beta distribution corresponding to each of the two mutants, and the one with the larger sample number is selected as the mutation path used for this mutation.

[0044] III. Collaborative Iteration of Multiple Language Model Agents

[0045] In this embodiment, an outer coordinator composed of multiple large language model agents is set on top of the fuzz tester. In each iteration, the outer coordinator schedules three types of large language model agents: coverage analysis agents, mutant writing agents, and test case generation agents. Each of the multiple large language model agents maintains its own independent persistent memory file.

[0046] (1) Coverage Analysis Agent: The coverage analysis agent is responsible for reading the source code coverage file, performing global coverage analysis on the target under test, identifying uncovered code regions or program behaviors, and generating exploration direction text to guide subsequent mutation and test case generation. Specifically, the agent is prompted to work in the following manner: First, use the coverage data processing tools llvm-profdata and llvm-cov to merge and parse the source code coverage file to obtain a source code coverage report; then, combine the source code of the target under test to analyze whether the uncovered regions correspond to triggerable program behaviors, and output exploration direction text in natural language form. The exploration direction text is used as input for the mutant writing agent and the test case generation agent.

[0047] (2) Mutator Writing Agent: The mutant writing agent is responsible for writing a new mutation strategy module based on the exploration direction text output by the coverage analysis agent and the source code of the target being tested. Specifically, the agent generates a new mutation strategy module written in Python and sends a hot-load instruction to the mutation server through the control socket. The hot-load instruction carries the file path of the new module. After receiving the instruction, the mutation server atomically replaces the currently used mutation strategy module. To ensure that a target-specific mutation strategy is available when the fuzzing activity starts, this embodiment calls the mutant writing agent once before the fuzzer starts to generate an initial mutation strategy module.

[0048] (3) Test Case Generation Agent: The test case generation agent is responsible for generating one or more test case files directly based on the exploration direction text output by the coverage analysis agent and the source code of the target under test. In order to introduce the test cases generated by the above agent into the corpus of the fuzzer, this embodiment sets a test case injection stage in the stage list of the fuzzer. Each time it is scheduled, it traverses the files in the test case directory generated by the agent, reads the contents of each file as a fuzzing input and submits it to the fuzzer for evaluation.

[0049] After the fuzzing activity is initiated, the outer coordinator iteratively schedules the three types of large language model agents. Each iteration proceeds as follows: first, the coverage analysis agent is synchronously invoked to obtain the exploration direction text for this round; then, the mutant agent writing agent and test case generation agent are concurrently initiated in an asynchronous task group. To avoid experience loss of the large language model agents between iterations, this embodiment maintains a persistent memory file for each type of large language model agent. This persistent memory file is read by the agent itself each time it is invoked and updated by the agent itself upon task completion. It includes structured information of the target source code, input format constraints, explored and unexplored code regions, valid and invalid exploration directions, and mutation strategy experience.

[0050] It should be noted that the above embodiments are not intended to limit the scope of protection of the present invention. Equivalent transformations or substitutions made based on the above technical solutions all fall within the scope of protection of the claims of the present invention.

Claims

1. A coverage-guided grey-box fuzzy testing method based on large language model agent collaboration, characterized in that, Includes the following steps: (1) Construct a test environment for performing fuzz testing on the target under test. The test environment includes a fuzzer, a mutation server, a source code coverage collector, and multiple large language model agents. The fuzzer is linked to a pre-built instrumented target program and collects code coverage information, execution time information, and abnormal termination status during the execution of test cases. The mutation server loads a dynamically replaceable mutation strategy module and provides mutation services to the fuzzer through a first inter-process communication channel. The mutation server also listens to a second inter-process communication channel independent of the first inter-process communication channel. The second inter-process communication channel is used to receive hot-loading instructions for mutation strategies. For each test case that is about to be added to the fuzz test corpus and is determined to be a new coverage, the source code coverage collector uses the test case as input and executes a pre-built source code coverage instrumentation binary to collect the source code coverage file. (2) During the fuzz test, before each mutation, the fuzz tester adaptively schedules between two mutation paths, the traditional byte mutant and the large language model mutant, based on Thompson sampling. The fuzz tester maintains a Beta distribution parameter consisting of a success count and a failure count for each mutation path. It takes whether a new coverage is generated after each mutation as the observation result of the Bernoulli trial and updates the Beta distribution parameter of the corresponding mutation path. Before each mutation, it independently samples two random numbers from the posterior of the Beta distribution of the two mutation paths and uses the one with the larger sample number as the mutation path used for this mutation. The traditional byte mutant performs mutation based on a preset set of byte-level operations, and the large language model mutant sends the current input to the mutation server through the first inter-process communication channel and receives the byte sequence processed by the mutation strategy module. (3) During the fuzzing process, multiple large language model agents are coordinated and scheduled in an iterative manner. In each iteration, the coverage analysis agent first reads the source code coverage file, performs global coverage analysis on the target under test, identifies the code regions or program behaviors that have not yet been covered, and generates exploration direction text to guide subsequent mutation and test case generation. Then, the mutant writing agent generates a new mutation strategy module corresponding to the current iteration identifier based on the exploration direction text and the source code of the target under test, and notifies the mutation server to load the new mutation strategy module through the second inter-process communication channel. At the same time, the test case generation agent generates one or more test case files based on the exploration direction text and the source code of the target under test. The fuzzer is equipped with a test case injection stage. The test case injection stage traverses the test case files generated by the test case generation agent each time it is scheduled, reads the file content into the fuzzer, and performs evaluation.

2. The coverage-guided gray-box fuzzy testing method based on large language model agent collaboration according to claim 1, characterized in that, In step (1), the code coverage information includes at least basic code block coverage information or edge coverage information; the inter-process communication channel includes sockets, shared memory, message queues, pipes and memory mapping; the source code coverage includes at least line coverage, function coverage and branch coverage.

3. The coverage-guided grey-box fuzzy testing method based on large language model agent collaboration according to claim 1, characterized in that, In step (2), the initial value of the Beta distribution is set to be equivalent to the uniform prior Beta distribution Beta(1,1). The step of sampling from the posterior of the Beta distribution is constructed using the Gamma distribution. Specifically, it includes sampling two random numbers from two Gamma distributions with shape parameters of success count and failure count, respectively, and normalizing the first random number with the sum of the two random numbers as the sampling result of the Beta distribution. When the sum of the two random numbers is zero, a preset value is returned as the sampling result. After each mutation, the success of the mutation is determined by whether it results in the addition of new test cases to the corpus. Based on this, the Beta distribution parameters corresponding to the most recently used mutation path are updated. The preset set of byte-level operations used by traditional byte mutants includes at least one of the following: 1) Flip a single bit at a randomly selected position in the current input; 2) Invert the bits of a single byte randomly selected from the current input; 3) Replace the byte at a randomly selected position in the current input with a preset 8-bit constant; 4) Replace two consecutive bytes at a randomly selected position in the current input with a preset 16-bit constant, and randomly select big-endian or little-endian order during the replacement; 5) Replace four consecutive bytes at a randomly selected position in the current input with a preset 32-bit constant, and randomly select big-endian or little-endian order during the replacement; 6) Replace the byte at a randomly selected position in the current input with a pseudo-random byte; 7) Delete consecutive bytes in the current input starting at a randomly selected position and with a randomly selected length; 8) Insert a pseudo-random byte of random length at a randomly selected position in the current input; 9) Copy the bytes of a randomly selected range in the current input and insert them into a randomly selected position in the current input; 10) Overwrite the bytes of a randomly selected range in the current input with pseudo-random bytes; 11) Swap bytes at two randomly selected positions in the current input; 12) Randomly select another test case from the corpus queue, randomly select splicing points in the current input and the other test case respectively, and splice the byte sequence of the other test case after its splicing point to the splicing point of the current input to form a new byte sequence.

4. The coverage-guided grey-box fuzzy testing method based on large language model agent collaboration according to claim 1, characterized in that, In step (3), after receiving the hot loading instruction for the mutation strategy, the mutation server dynamically loads the new mutation strategy module as the mutation strategy module used by the mutation server according to the path or content of the new mutation strategy module carried in the instruction. If an abnormality occurs during the loading process, the original mutation strategy module is retained to continue providing services.

5. The coverage-guided grey-box fuzzy testing method based on large language model agent collaboration according to claim 1, characterized in that, In step (3), a persistent memory file is maintained for each type of large language model agent. The persistent memory file is read by the agent itself each time it is invoked and updated by the agent itself when the task is completed. The persistent memory file includes at least the structured information of the source code of the target under test, input format constraints, explored and unexplored code regions, effective and invalid exploration directions, and mutation strategy experience. In the initialization phase of the fuzzing activity, before starting the fuzzer, the agent writing agent and the test case generation agent can be invoked once or multiple times to generate the initial mutation strategy module based on the source code of the target under test and load it into the mutation server. The generated test case file is used as the seed for fuzzing. If the agent is not invoked, the mutation server loads its default mutation strategy module, and the fuzzer loads the user-provided file or a randomly generated file as the seed for fuzzing.

6. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the program, it implements the coverage-guided gray-box fuzzy testing method based on large language model intelligent agent collaboration as described in any one of claims 1 to 5.

7. A computer-readable storage medium storing computer instructions thereon, characterized in that, When executed by the processor, the computer instructions implement the coverage-guided gray-box fuzzy testing method based on large language model intelligent agent collaboration as described in any one of claims 1-5.

Images