An LLM-Guided Fuzzing of Proprietary Industrial Communication Protocols with Context Knowledge

摘要

Existing fuzzing tools struggle to analyze proprietary Industrial Communication Protocols (ICPs) due to the lack of detailed protocol specifications. Consequently, they often rely on manual analysis or coarse-grained black-box approaches, which offer limited insight into protocol field semantics. This ultimately restricts both the coverage and depth of the testing process. To address these limitations, we propose a novel fuzzing framework called ICProFuzz, which leverages Large Language Models (LLMs) to understand proprietary ICPs. ICProFuzz utilizes LLMs to deeply analyze captured communication messages and available partial protocol descriptions. This enables the automated extraction of field semantics, length constraints, and inter-field dependencies. Utilizing the inferred field types and syntactic formats, we design a suite of advanced mutation strategies, including boundary value injection, format-preserving assignment, and protocol-aware keyword insertion. Finally, the generated test cases are fed into the fuzzing engine, where both the semantic parsing and mutation strategies are dynamically adjusted based on test coverage and anomaly feedback. We conducted extensive evaluations using three widely used proprietary ICPs: S7comm, UMAS, and CIP. The experimental results show that ICProFuzz outperforms traditional baseline fuzzers in vulnerability identification, path coverage, and branch coverage. Moreover, ICProFuzz identified 14 vulnerabilities across six real devices, including two zero-day vulnerabilities.