LLM-Boofuzz: Generation-Based Black-Box Fuzzing for Network Protocols via LLMs
Open accessAbstract
Identifying network protocol vulnerabilities is critical for cyberspace security. Generation-based black-box protocol fuzzing is widely used but faces challenges: over-reliance on manual protocol analysis and script writing, single-threaded fuzzing, and lack of dynamic fuzzing strategy optimization. To address these, we propose LLM-Boofuzz, a generation-based black-box protocol fuzzing framework via Large Language Models (LLMs). It leverages LLMs to parse real traffic to extract protocol information, guides LLMs to generate executable scripts with a repair mechanism, and enables multi-script iterative fuzzing via an LLM-based agent. Experiments show that LLM-Boofuzz outperforms state-of-the-art tools: it triggers all 15 test vulnerabilities (vs. 8/7/7 for Boofuzz/Snipuzz/AFLNet) and achieves an average 53.4% code line coverage on two protocol programs (vs. 30.65%/31.95%/41.65%), providing an efficient solution for network protocol fuzzing.
Integrity signals
Registry
Cites
Statistics
Claims the paper makes
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
An LLM that has read the Modbus or MQTT specification can construct protocol-valid inputs that pass parsing layers and probe deeper handlers.
“First, semantic input generation: an LLM that has read the Modbus or MQTT specification can construct protocol-valid inputs that pass parsing layers and probe deeper handlers [109].”
From Agentic AI and Large Language Models for Autonomous IoT Cybersecurity: A Systematic Survey, Taxonomy, and Research Roadmap (2026) · cites this paper as [109]
Cites
Prompt Engineering with ChatGPT: A Guide for Academic Writers
Giray, L. (2023) · Annals of Biomedical Engineering · doi:10.1007/s10439-023-03272-4 · Cited by 776 · see citing works
Pezoa, F., Reutter, J. L., Suarez, F., Ugarte, M., & Vrgoč, D. (2016) · International World Wide Web Conference (WWW) · doi:10.1145/2872427.2883029 · Cited by 436 · see citing works
AFLNET: A Greybox Fuzzer for Network Protocols
Pham, V.-T., Böhme, M., & Roychoudhury, A. (2020) · doi:10.1109/icst46399.2020.00062 · Cited by 346 · see citing works
Zhu, X., Wen, S., Camtepe, S. A., & Xiang, Y. (2022) · ACM Computing Surveys · doi:10.1145/3512345 · Cited by 341 · see citing works
Li, J., Zhao, B., & Zhang, C. (2018) · Cybersecurity · doi:10.1186/s42400-018-0002-y · Cited by 279 · see citing works
Snipuzz: Black-box Fuzzing of IoT Firmware via Message Snippet Inference
Feng, X., Sun, R., Zhu, X., Xue, M., Wen, S., Liu, D., Nepal, ., & Xiang, Y. (2021) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/3460120.3484543 · Cited by 171 · see citing works
StateAFL: Greybox fuzzing for stateful network servers
Natella, R. (2022) · Empirical Software Engineering · doi:10.1007/s10664-022-10233-3 · Cited by 143 · see citing works
Singh, B. (2024) · Apress eBooks · doi:10.1007/979-8-8688-0569-1_4 · Cited by 141 · see citing works
Prompt Engineering a Prompt Engineer
Ye, Q., Ahmed, M., Pryzant, R., & Khani, F. (2024) · Findings of the Association for Computational Linguistics: ACL (Findings of ACL) · doi:10.18653/v1/2024.findings-acl.21 · Cited by 109 · see citing works
Zhu, X., & Böhme, M. (2021) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/3460120.3484596 · Cited by 97 · see citing works
SNPSFuzzer: A Fast Greybox Fuzzer for Stateful Network Protocols Using Snapshots
Li, J., Li, S., Sun, G., Chen, T., & Yu, H. (2022) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2022.3192991 · Cited by 76 · see citing works
Demystify the Fuzzing Methods: A Comprehensive Survey
Mallissery, S., & Wu, Y. (2023) · ACM Computing Surveys · doi:10.1145/3623375 · Cited by 68 · see citing works
LLMIF: Augmented Large Language Model for Fuzzing IoT Devices
Wang, J., Yu, L., & Luo, X. (2024) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp54263.2024.00211 · Cited by 68 · see citing works
Sharma, P., & Yegneswaran, V. (2023) · ACM Workshop on Hot Topics in Networks (HotNets) · doi:10.1145/3626111.3628205 · Cited by 51 · see citing works
How Effective Are They? Exploring Large Language Model Based Fuzz Driver Generation
Zhang, C., Zheng, Y., Bai, M., Li, Y., Ma, W., Xie, X., Li, Y., Sun, L., & Liu, Y. (2024) · ACM SIGSOFT International Symposium on Software Testing and Analysis (ISSTA) · doi:10.1145/3650212.3680355 · Cited by 47 · see citing works
Self-citationA systematic review of fuzzing
Zhao, X., Qu, H., Xu, J., Li, X., Lv, W., & Wang, G. (2023) · Soft Computing · doi:10.1007/s00500-023-09306-2 · Cited by 35 · see citing works
A Survey on the Development of Network Protocol Fuzzing Techniques
Zhang, Z., Zhang, H., Zhao, J., & Yin, Y. (2023) · Electronics · doi:10.3390/electronics12132904 · Cited by 29 · see citing works
Guiding Greybox Fuzzing with Mutation Testing
Vikram, V., Laybourn, I., Li, A., Nair, N., OBrien, K., Sanna, R., & Padhye, R. (2023) · ACM SIGSOFT International Symposium on Software Testing and Analysis (ISSTA) · doi:10.1145/3597926.3598107 · Cited by 25 · see citing works
Network protocol fuzz testing for information systems and applications: a survey and taxonomy
Munea, T. L., Lim, H., & Shon, T. (2015) · Multimedia Tools and Applications · doi:10.1007/s11042-015-2763-6 · Cited by 24 · see citing works
ChatHTTPFuzz: large language model-assisted IoT HTTP fuzzing
Yang, Z., Hao, P., Jiang, Y., Li, X., Du, H., Wang, S., & Liu, J. (2025) · International Journal of Machine Learning and Cybernetics · doi:10.1007/s13042-024-02527-3 · Cited by 22 · see citing works
Simèon, J., & Wadler, P. L. (2003) · ACM SIGPLAN Notices · doi:10.1145/640128.604132 · Cited by 13 · see citing works
Maklad, Y., Wael, F., Elsersy, W. F., & Hamdi, A. (2025) · Lecture notes in networks and systems · doi:10.1007/978-981-96-6441-2_27 · Cited by 5 · see citing works
A Rapid Review on Fuzz Security Testing for Software Protocol Implementations
Marchetto, A. (2023) · Lecture notes in computer science · doi:10.1007/978-3-031-43240-8_1 · Cited by 4 · see citing works
SGMFuzz: State Guided Mutation Protocol Fuzzing
Wen, Z., Yu, J., Huang, Z., Wu, Y., Hong, Z., & Ranjan, R. K. (2025) · IEEE Networking Letters · doi:10.1109/lnet.2025.3526776 · Cited by 3 · see citing works
PS-Fuzz: Efficient Graybox Firmware Fuzzing Based on Protocol State
Li, X., Pan, X., & Sun, Y. (2021) · Journal on artificial intelligence · doi:10.32604/jai.2021.017328 · Cited by 3 · see citing works
DSFuzz: deep state of stateful protocol fuzzing
Han, Z., & Xu, X. (2024) · International Conference on Computer Engineering and Application (ICCEA) · doi:10.1109/iccea62105.2024.10603807 · Cited by 1 · see citing works
Flagged first, then by citations
Cited by
Sorted by citations
Nageshwaran, V., & Ezekiel, S. (2026) · Electronics · doi:10.3390/electronics15122740 · Cited by 4 · see citing works
“…[40] performs LLM-guided command-injection detection in IoT web services; LLM-powered protected-interface evasion frameworks discover broken access control in IoT firmware [120]; LLM-Boofuzz [109] orchestrates black-box protocol fuzzing with LLM-generated test cases against MQTT and CoAP stacks.”
InfluentialNetPuzz: Testing Network Printers via Fully Black-Box and Feedback-Guided Protocol Fuzzing
Bai, J.-J., Hu, R.-N., Li, C., Chen, J., Chen, R., & Guan, Z. (2026) · IEEE Transactions on Dependable and Secure Computing · doi:10.1109/tdsc.2026.3677524
Industrial Protocol Data Model and State Model Generation Based on Large Language Model
Liao, S., Hao, R., Zhao, D., Zheng, Q., Jiang, J., & Xiang, J. (2026) · Lecture notes in computer science · doi:10.1007/978-981-92-2759-4_45
An Iterative CoT-RAG Framework for Automated Fuzz Target Generation in Autonomous Driving Software
Kuo, J.-Y., Wang, P., Hsieh, T.-F., & Yang, C.-K. (2026) · International Conference on Advanced Robotics and Intelligent Systems (ARIS) · doi:10.1109/aris70457.2026.11734392
SFGFuzz: Field-Sensitivity-Guided Fuzzing for Vulnerability-Candidate Mining in Modbus TCP
Li, J., Wang, Y., Wang, W., Cong, L., & Yang, Y. (2026) · Lecture notes in computer science · doi:10.1007/978-981-92-6843-6_23
- Authors
- Wang, T., Li, Y., Pan, Z., Chen, Q., Li, Z., Zhang, Y., Shen, Y., Hu, M., & Chen, Q.
- Affiliations
- National University of Defense Technology (CN)
- Corresponding author
- Li, Yuwei
- Pan, Zulie
- Venue
- Electronics
- Publisher
- MDPI AG
- Published
- 2025-11-21
- Volume
- 14
- Issue
- 23
- Pages
- 4550
- ISSN
- 2079-9292 (ISSN-L)
- OpenAlex
- W4416457592
- Cited by
- 5
- References
- 26
- Citations by year
- 2026: 5
- FWCI
- 11.44
- Type
- journal article
- Language
- en
- Open access
- gold
- doi.org
- Licence
- Locations
- Electronics (publishedVersion, cc-by)
- Topics
- Physical Sciences › Computer Science › Software › Software Testing and Debugging Techniques
- Physical Sciences › Computer Science › Computer Networks and Communications › Network Security and Intrusion Detection
- Physical Sciences › Computer Science › Artificial Intelligence › Adversarial Robustness in Machine Learning
- Keywords
- black-box fuzzing, network protocol vulnerabilities, large language models, script generation, code coverage, network protocol security
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
