Distributed systems rely on complex messaging middleware, posing significant challenges for static analysis tools. Existing approaches often require manually specifying communication patterns between message senders and handlers—a process that is tedious, error-prone, and ill-suited to capture the semantic complexity of real-world systems with diverse routing logic. This paper introduces Hermes, an automated framework that leverages Large Language Models (LLMs) to bridge the semantic gap in distributed tracing. Key to our approach is the insight that "message types" serve as semantic contracts. Hermes leverages these types to synthesize latent routing logic into high-level communication patterns, which subsequently guide the precise discovery of concrete message flows from sender APIs to handlers. Evaluation on 10 real-world systems demonstrates that Hermes significantly outperforms existing approaches, achieving 88.6% precision and 99.6% recall in flow discovery. Applying Hermes to security auditing revealed 121 verified taint paths spanning 57 distinct sinks. These findings led to 56 confirmed zero-day vulnerabilities, of which 53 have been fixed and 7 assigned CVE IDs.

@inproceedings{paperbot12573,
  title = {Tracing the Invisible: Semantic Message Flow Discovery via Data Contracts in Real-World Distributed Systems},
  author = {Youlong Chen and Jie Lu and Mingtao Huang and Chenghang Shi and Yongheng Huang and Haofeng Li and Dong Liu and Mengna Ma and Yong Liu and Qinfen Hao and Lian Li},
  booktitle = {ASE},
  year = {2026},
  doi = {10.1145/3832783.3834372}
}