Dynamic feedback-based vulnerability mining method for highly closed terminal protocols

Yong Wang; Wenting Wang; Dongchang Li

doi:10.1117/12.3058050

3 January 2025 Dynamic feedback-based vulnerability mining method for highly closed terminal protocols

Yong Wang, Wenting Wang, Dongchang Li

Author Affiliations +

Proceedings Volume 13519, Third International Conference on Communications, Information System, and Data Science (CISDS 2024); 135190G (2025) https://doi.org/10.1117/12.3058050
Event: Third International Conference on Communications, Information System and Data Science 2024, 2024, Nanjing, China

Abstract

This paper introduces a dynamic feedback-based vulnerability mining method tailored for highly closed terminal protocols, addressing the limitations of traditional fuzz testing methods which struggle with closed-source protocols due to the lack of accessible code or protocol specifications. The proposed method overcomes these barriers by generating test cases using Large Language Models (LLMs) and optimizing them through real-time execution feedback without a deep understanding of the protocol. The primary contributions include a balanced training set construction method for LLMs, integration of LLMs with fuzz testing to generate test cases without relying on protocol knowledge, and a real-time feedback mechanism from a state machine to LLMs for continuous test case optimization. The method’s effectiveness is validated through experiments on a closed-source protocol, MQTT, and SSH, demonstrating significant improvements over conventional AFL fuzz testing. The results show that the proposed method can identify up to 4.34 times more valid cases in closed-source protocols, highlighting its efficiency in vulnerability detection.

(2025) Published by SPIE. Downloading of the abstract is permitted for personal use only.

Citation Download Citation

Yong Wang, Wenting Wang, and Dongchang Li "Dynamic feedback-based vulnerability mining method for highly closed terminal protocols", Proc. SPIE 13519, Third International Conference on Communications, Information System, and Data Science (CISDS 2024), 135190G (3 January 2025); https://doi.org/10.1117/12.3058050

ACCESS THE FULL ARTICLE

INSTITUTIONAL
Select your institution to access the SPIE Digital Library.

SELECT YOUR INSTITUTION

PERSONAL
Sign in with your SPIE account to access your personal subscriptions or to use specific features such as save to my library, sign up for alerts, save searches, etc.

PERSONAL SIGN IN

No SPIE Account? Create one

;

PURCHASE THIS CONTENT

SUBSCRIBE TO DIGITAL LIBRARY

50 downloads per 1-year subscription

Members: $195

Non-members: $335 ADD TO CART

25 downloads per 1 - year subscription

Members: $145

Non-members: $250 ADD TO CART

PURCHASE SINGLE ARTICLE