用大模型自动检测网络协议实现与RFC规范的偏差，发现47个真实漏洞。
RFCAudit: An LLM Agent for Functional Bug Detection in Network Protocols
- 构建双阶段智能体：先生成代码语义索引，再按需检索关键代码片段
- 在6个真实协议中发现47个功能缺陷，准确率达81.9%
- 适合协议开发与安全审计人员，尤其关注实现与标准一致性
功能正确性对保障网络协议实现的可靠性与安全性至关重要。功能错误指实现与RFC文档规定的行为不一致，可能导致路由错误、认证绕过和服务中断等严重后果。传统静态分析工具难以完成跨规范文档与源码的深层语义分析。本文提出RFCAudit，一个基于大语言模型（LLM）的自主智能体，通过比对协议实现与RFC规范来检测功能错误。受人工审计流程启发，RFCAudit包含索引代理和检测代理两个核心组件：前者分层总结协议代码语义，生成语义索引以缩小扫描范围；后者采用按需检索机制，迭代获取相关数据结构与函数，最终高效识别与RFC规范的潜在不一致。我们在六个真实网络协议实现上评估了RFCAudit，共发现47个功能错误，准确率达81.9%，其中20个已被开发者确认或修复。
原文摘要 · Abstract (English)
Functional correctness is critical for ensuring the reliability and security of network protocol implementations. Functional bugs, instances where implementations diverge from behaviors specified in RFC documents, can lead to severe consequences, including faulty routing, authentication bypasses, and service disruptions. Detecting these bugs requires deep semantic analysis across specification documents and source code, a task beyond the capabilities of traditional static analysis tools. This paper introduces RFCAudit, an autonomous agent that leverages large language models (LLMs) to detect functional bugs by checking conformance between network protocol implementations and their RFC specifications. Inspired by the human auditing procedure, RFCAudit comprises two key components: an indexing agent and a detection agent. The former hierarchically summarizes protocol code semantics, generating semantic indexes that enable the detection agent to narrow down the scanning scope. The latter employs demand-driven retrieval to iteratively collect additional relevant data structures and functions, eventually identifying potential inconsistencies with the RFC specifications effectively. We evaluate RFCAudit across six real-world network protocol implementations. RFCAudit identifies 47 functional bugs with 81.9% precision, of which 20 bugs have been confirmed or fixed by developers.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。