🤖 AI Summary
Addressing the challenges of low detection efficacy for Industrial Control Protocol (ICP) vulnerabilities, poor coverage, and high false-positive rates in conventional fuzzing, this paper proposes MALF—a Multi-Agent Large-model Fuzzing framework. MALF introduces a novel multi-agent collaborative architecture that synergistically integrates domain-knowledge enhancement with protocol-aware generation. It incorporates Retrieval-Augmented Generation (RAG), QLoRA-based lightweight fine-tuning, feedback-driven mutation, and Shannon-entropy-guided diversity control to establish a dynamic closed loop spanning protocol understanding, seed generation, and feedback-based optimization. Evaluated on mainstream protocols including Modbus/TCP, MALF achieves 88–92% test pass rates and >90% seed coverage, uncovering three CNVD-certified zero-day vulnerabilities. Its vulnerability detection rate significantly outperforms state-of-the-art approaches.
📝 Abstract
Industrial control systems (ICS) are vital to modern infrastructure but increasingly vulnerable to cybersecurity threats, particularly through weaknesses in their communication protocols. This paper presents MALF (Multi-Agent LLM Fuzzing Framework), an advanced fuzzing solution that integrates large language models (LLMs) with multi-agent coordination to identify vulnerabilities in industrial control protocols (ICPs). By leveraging Retrieval-Augmented Generation (RAG) for domain-specific knowledge and QLoRA fine-tuning for protocol-aware input generation, MALF enhances fuzz testing precision and adaptability. The multi-agent framework optimizes seed generation, mutation strategies, and feedback-driven refinement, leading to improved vulnerability discovery. Experiments on protocols like Modbus/TCP, S7Comm, and Ethernet/IP demonstrate that MALF surpasses traditional methods, achieving a test case pass rate (TCPR) of 88-92% and generating more exception triggers (ETN). MALF also maintains over 90% seed coverage and Shannon entropy values between 4.2 and 4.6 bits, ensuring diverse, protocol-compliant mutations. Deployed in a real-world Industrial Attack-Defense Range for power plants, MALF identified critical vulnerabilities, including three zero-day flaws, one confirmed and registered by CNVD. These results validate MALF's effectiveness in real-world fuzzing applications. This research highlights the transformative potential of multi-agent LLMs in ICS cybersecurity, offering a scalable, automated framework that sets a new standard for vulnerability discovery and strengthens critical infrastructure security against emerging threats.