一句话：提出基于 LLM 的自主审计 agent，检查协议实现与 RFC 规范的一致性，在六个真实实现中发现 47 个功能缺陷。
网络协议实现的功能正确性至关重要，实现与 RFC 规范行为的偏离会导致路由错误、认证绕过和服务中断等严重后果。检测这类功能缺陷需要在规范文档与源代码之间进行深层语义分析，超出传统静态分析工具的能力范围。本文提出 RFCAudit，一个利用大语言模型（LLM）检测协议实现与 RFC 规范不一致的自主 agent。受人工审计流程启发，系统由两个组件构成：索引 agent 层次化地总结协议代码语义，生成语义索引以帮助检测 agent 缩小扫描范围；检测 agent 采用按需检索的方式迭代收集相关的数据结构与函数，最终有效识别与 RFC 规范的潜在不一致。作者在六个真实网络协议实现上评估 RFCAudit，共发现 47 个功能缺陷，精确率达 81.9%，其中 20 个已获开发者确认或修复。
Functional correctness is critical for ensuring the reliability and security of network protocol implementations. Functional bugs, instances where implementations diverge from behaviors specified in RFC documents, can lead to severe consequences, including faulty routing, authentication bypasses, and service disruptions. Detecting these bugs requires deep semantic analysis across specification documents and source code, a task beyond the capabilities of traditional static analysis tools. This paper introduces RFCAudit, an autonomous agent that leverages large language models (LLMs) to detect functional bugs by checking conformance between network protocol implementations and their RFC specifications. Inspired by the human auditing procedure, RFCAudit comprises two key components: an indexing agent and a detection agent. The former hierarchically summarizes protocol code semantics, generating semantic indexes that enable the detection agent to narrow down the scanning scope. The latter employs demand-driven retrieval to iteratively collect additional relevant data structures and functions, eventually identifying potential inconsistencies with the RFC specifications effectively. We evaluate RFCAudit across six real-world network protocol implementations. RFCAudit identifies 47 functional bugs with 81.9% precision, of which 20 bugs have been confirmed or fixed by developers.
DOI 原文 ·
@inproceedings{paperbot9373,
title = {RFCAudit: AI Agent for Auditing Protocol Implementations Against RFC Specifications},
author = {Mingwei Zheng and Chengpeng Wang and Xuwei Liu and Jinyao Guo and Shiwei Feng and Xiangyu Zhang},
booktitle = {ASE},
year = {2025},
doi = {10.1109/ase63991.2025.00105}
}