arXiv:2508.14300cs.CRcs.CL2025-08被引 1

用检索增强的多智能体系统,让协议模糊测试更智能、更全面。

MultiFuzz: A Dense Retrieval-based Multi-Agent System for Network Protocol Fuzzing

  • 基于文档检索生成,让智能体理解协议语义并生成合规输入。
  • 在RTSP上实现更高分支覆盖率和更深状态探索,优于现有工具。
  • 适合安全研究者与自动化测试开发人员使用,提升漏洞发现效率。

传统协议模糊测试方法(如AFL系)因对复杂协议语法理解有限且种子变异策略僵化,效果不佳。近期工作如ChatAFL引入大语言模型(LLM)以扩展协议状态空间探索,但仍存在输出不可靠、幻觉及假设模型熟知协议规范等问题。本文提出MultiFuzz,一种基于密集检索的多智能体系统,通过语义感知上下文检索、专用智能体与结构化工具辅助推理,克服上述缺陷。该系统将协议文档(如RFC)切分为智能体可处理的片段,构建向量数据库,支持检索增强生成(RAG)管道,使智能体生成更可靠、结构化的输入,提升协议消息变异时的状态覆盖与语法合规性。框架将模糊测试过程分解为模块化智能体组,通过思维链推理协同,动态依据检索知识调整策略。在实时流媒体协议(RTSP)上的实验表明,MultiFuzz显著提升分支覆盖率,深入探索更多协议状态与转移,优于NSFuzz、AFLNet与ChatAFL等当前最先进工具。结合密集检索、智能体协作与语言模型推理,MultiFuzz建立了一种新型自主协议模糊测试范式,为未来智能代理式模糊测试提供可扩展、可拓展的基础。

原文摘要 · Abstract (English)

Traditional protocol fuzzing techniques, such as those employed by AFL-based systems, often lack effectiveness due to a limited semantic understanding of complex protocol grammars and rigid seed mutation strategies. Recent works, such as ChatAFL, have integrated Large Language Models (LLMs) to guide protocol fuzzing and address these limitations, pushing protocol fuzzers to wider exploration of the protocol state space. But ChatAFL still faces issues like unreliable output, LLM hallucinations, and assumptions of LLM knowledge about protocol specifications. This paper introduces MultiFuzz, a novel dense retrieval-based multi-agent system designed to overcome these limitations by integrating semantic-aware context retrieval, specialized agents, and structured tool-assisted reasoning. MultiFuzz utilizes agentic chunks of protocol documentation (RFC Documents) to build embeddings in a vector database for a retrieval-augmented generation (RAG) pipeline, enabling agents to generate more reliable and structured outputs, enhancing the fuzzer in mutating protocol messages with enhanced state coverage and adherence to syntactic constraints. The framework decomposes the fuzzing process into modular groups of agents that collaborate through chain-of-thought reasoning to dynamically adapt fuzzing strategies based on the retrieved contextual knowledge. Experimental evaluations on the Real-Time Streaming Protocol (RTSP) demonstrate that MultiFuzz significantly improves branch coverage and explores deeper protocol states and transitions over state-of-the-art (SOTA) fuzzers such as NSFuzz, AFLNet, and ChatAFL. By combining dense retrieval, agentic coordination, and language model reasoning, MultiFuzz establishes a new paradigm in autonomous protocol fuzzing, offering a scalable and extensible foundation for future research in intelligent agentic-based fuzzing systems.

协议模糊测试多智能体检索增强安全检测

Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。