一句话：提出 FuzzCM，用 RAG 增强 LLM 自动生成协议模糊测试模板，结合 GPIO 覆盖率与混合变异，在商业通信模块发现 21 个新缺陷。
商业通信模块的协议模糊测试面临模板生成耗时、缺乏覆盖率采集、测试性能受限以及软硬件 CI/CD 流程不一致等挑战。本文与中国移动物联网合作，提出 FuzzCM 框架：利用检索增强生成（RAG）增强的大语言模型自动生成协议测试模板，采用基于 GPIO 的插桩高效采集运行时覆盖率，并借助历史测试知识库指导混合变异策略，同时打通软硬件层 CI/CD 以支持持续且环境感知的测试。作者在五款 LTE Cat.1 bis 模块上开展工业实践，发现 21 个此前未知的缺陷，其中 15 个已修复；FuzzCM 的覆盖率相较人工方法和 Peach* 方法分别平均提升 51% 和 29%，总体覆盖率达到 85%。
Fuzzing is widely used for software robustness testing. However, its application in commercial communication modules remains limited due to several key challenges, including labor-intensive template generation, lack of coverage collection support, limited testing performance, and inconsistencies between practical hardware and software CI/CD processes. In collaboration with China Mobile IoT, we present FuzzCM, a comprehensive protocol fuzzing framework tailored for commercial communication modules. FuzzCM employs a Retrieval-Augmented Generation (RAG)-enhanced large language model (LLM) to automate template generation and utilizes GPIO-based instrumentation for efficient runtime coverage data collection. Additionally, it leverages a knowledge base constructed from prior tests to guide hybrid mutation strategies and integrates CI/CD across both software and hardware layers, enabling continuous and environment-aware testing. We conducted an industrial practice with FuzzCM on five LTE Cat.1 bis modules, identifying 21 previously unknown bugs, 15 of which have been fixed. The results demonstrate that FuzzCM outperforms both manual methods and the Peach* approach, achieving average coverage improvements of 51% and 29%, respectively, with overall coverage reaching 85%.
DOI 原文 ·
@inproceedings{paperbot9478,
title = {Industry Practice of LLM-Assisted Protocol Fuzzing for Commercial Communication Modules},
author = {Qiang Fu and Changjian Liu and Yuan Ding and Chao Fan and Yulai Fu and Yuhan Chen and Ying Fu and Ronghua Shi and Fuchen Ma and Heyuan Shi},
booktitle = {ASE},
year = {2025},
doi = {10.1109/ase63991.2025.00260}
}