AFL-ICP: Enhancing Industrial Control Protocol Reliability via Specification-Guided Fuzzing Jiaying Meng† ,
arXiv:2605.04760v1 [cs.CR] 6 May 2026
†
Zhongguancun Lab
‡
Xuewei Feng‡ ,
Tsinghua University
§
Qi Li‡† ,
Min Liu§† ,
Ke Xu‡†
Institute of Computing Technology, Chinese Academy of Sciences
Abstract—Industrial Control Protocols (ICPs) are critical to the reliability and stability of industrial infrastructure, yet their security is fundamentally compromised by a specification-blindness bottleneck. Modern fuzzers, constrained by observation-driven inference struggle to penetrate deep protocol states or detect subtle semantic deviations. In this paper, we present AFL-ICP, an autonomous fuzzing framework that pioneers a specificationdriven paradigm. AFL-ICP features a context-aware specification formalization pipeline to transform complex specifications into rigorous machine-executable grammars. Building on this formalized specification, AFL-ICP leverages LLMs to enable automated protocol adaptation and seed generation, allowing for rapid extension to new protocols with minimal manual effort. Additionally, it includes an LLM-powered differential checker that cross-references implementation outputs with specification requirements to detect subtle semantic and logic bugs that existing fuzzers cannot detect. We implement AFL-ICP and evaluate it on four widely used ICPs, including both open-source and closed-source variants. Results show that AFL-ICP significantly outperforms state-of-the-art fuzzers in coverage and uncovers 24 previously unknown vulnerabilities, for which we have received acknowledgments from affected vendors (e.g., FreyrSCADA). Specifically, the identified vulnerabilities include 16 semantic and logic bugs that can silently disrupt industrial operations and degrade service availability. Index Terms—Fuzzing, Industrial Control Protocol, Security
I. I NTRODUCTION Industrial Control Protocols (ICPs) serve as the backbone of industrial environments, orchestrating real-time communication and command execution across heterogeneous devices. Early ICPs operated in physically isolated environments, which led to the design of many protocols without built-in security mechanisms such as authentication and encryption. However, as the isolation and obscurity of industrial networks have diminished, the number of attacks exploiting ICPs has rapidly increased. These attacks not only compromise system reliability and availability, but also pose significant threats to critical infrastructure in the transportation and energy sectors [1]. Protocol fuzzing has emerged as a critical technique for ensuring quality of service (QoS) in industrial networks, as it proactively identifies implementation vulnerabilities that could degrade system reliability [2], [3]. However, fuzzing ICPs remains fundamentally limited by a Specification-Blindness bottleneck. This cognitive gap manifests in two dimensions: i) The Input Dimension: Existing fuzzers operate as blackbox or grey-box observers, inferring protocol logic solely from implementation feedback or captured traffic. Since they lack access to the ground-truth rules defined in natural language specifications, they have to rely on inductive reasoning from
observed information to construct protocol state machines. This approach inherently under-fits the complex logic of ICPs, failing to discover “dark” states and transitions that are defined in the specification but absent in observations. Consequently, they struggle to generate the precise, state-aware sequences required to penetrate deep protocol logic. ii) The Output Dimension: Traditional fuzzers rely on generic fault signals (e.g., crashes or hangs) as oracles. However, they lack the semantic understanding to verify whether a noncrashing response conforms to the specification’s “correctness contract.” This leaves them blind to semantic deviations, which leads to subtle failures that do not crash the system but disrupt state synchronization, bypass validation logic, or leak sensitive information, directly undermining the stability and reliability of critical infrastructure. We argue that the protocol specification serves as the ultimate ground-truth for correctness, yet it remains inaccessible to traditional fuzzers due to its unstructured nature. To break the specification-blindness bottleneck, a paradigm shift is required: from observation-driven inference to specificationguided generation and verification for both input and output. Recent breakthroughs in Large Language Models (LLMs) provide the missing link for this transformation. LLMs possess the capability to distill rigorous formal constraints (e.g., state machines, packet schemas) from ambiguous natural language descriptions. This positions them not merely as auxiliary tools [4], but as the fundamental semantic bridge capable of translating human-readable standards into machine-executable fuzzing policies. However, unlocking this potential is non-trivial. Our preliminary experiments reveal that off-the-shelf LLMs struggle to formalize complex ICP standards directly. When fed raw specifications, LLMs frequently exhibit context rot and hallucinations, failing to maintain the strict semantic fidelity required for protocol fuzzing. These failures highlight two critical technical barriers: (C1) Inaccurate Understanding of Specifications: ICP specifications are lengthy and multimodal, often exceeding the effective context window of LLMs. Naive retrieval or summarization fragments the protocol logic, leading to misinterpretations of cross-page dependencies and state transition rules. (C2) Ineffective Representation of Semantics: LLMs struggle to zero-shot transform unstructured specifications into the rigorous, machine-readable formats required by fuzzers. Without domain-specific schemas to constrain the output, generated structures are often verbose, inconsistent, or omit critical details, preventing direct integration with
downstream fuzzing components. then, it remains confined to detecting shallow memory safety To surmount these barriers, we introduce a context-aware violations. Our work redefines this traditional workflow by specification formalization methodology that systematically introducing an AI-native, specification-driven paradigm. This transforms complex, multimodal ICP specifications into struc- transformation yields two distinct advantages: tured, machine-readable formats. To address the challenge (C1), i) Orchestrating Autonomous Workflows: We elevate prewe employ content-aware segmentation, multimodal layout fuzzing stages from labor-intensive manual tasks to autonomous reconstruction, and semantic relevance denoising. These mech- or AI-accelerated processes. Specifically, we transition specifianisms effectively filter out irrelevant noise while preserving cation parsing, protocol adaptation, and initial seed generation critical grammar structures, ensuring an accurate understanding to purely AI-driven pipelines. This fundamentally mitigates the of the lengthy document. To resolve the challenge (C2), scalability bottlenecks inherent in manual fuzzing campaigns. we design a universal protocol schema comprising three ii) Expanding vulnerability Detection Capabilities: While complementary formats to capture accurate protocol grammar traditional fuzzers are constrained to identifying memory safety and enforce strict correctness through an adversarial consistency violations, our specification-aware design enables the discovery verification loop. of semantic and logic bugs, directly assuring protocol QoS. Building on this formalized specification, we design AFLICP, an autonomous fuzzing framework that systematically B. Challenges in ICPs Fuzzing integrates LLMs into every phase of the workflow. For the input dimension, AFL-ICP utilizes the formalized specifi- i) Specification Parsing: The Multimodal Barrier. Automatcation to enable automated protocol adaptation and seed ing ICP specification processing faces unique challenges. First, generation, allowing for rapid extension to new protocols the sheer scale exceeds the context window of current models. with minimal manual effort. For the output dimension, the Unlike the HTTP/1.1 standard (RFC 7230–7235, 305 pages, framework includes an LLM-powered differential checker that 380 KB in PDF), ICP specifications are voluminous (e.g., cross-references implementation outputs with specification EtherNet/IP spans 1,444 pages, 7.6 MB in PDF), making requirements to detect subtle semantic and logic bugs that direct processing prohibitive and leading to context rot. Second, existing fuzzers cannot detect. Evaluations on four widely- unlike standardized IETF protocols, ICP specifications are used ICPs (Modbus TCP, EtherNet/IP, IEC 104, and SLMP) often distributed as unstructured PDFs with critical protocol show that AFL-ICP significantly outperforms state-of-the-art information frequently presented through non-textual elements fuzzers in both state-space and code coverage, enabling the such as tabular and architectural diagrams. Naive text extraction discovery of 24 previously unknown vulnerabilities, including fails to preserve the layout of these elements, leading to loss of semantic information. Furthermore, many ICPs, originating 16 semantic and logic bugs. from legacy bus architectures, exhibit complex characterisContributions. Our main contributions are the following: tics, including numerous information fields, multilayer nested • We introduce the first end-to-end specification-driven fuzzing framework for ICP implementations, which operationalizes structures, and fine-grained control mechanisms. LLMs often natural-language specifications into machine-executable arti- struggle with these intricate details and subtle requirements. facts that drive both input generation and conformance check- ii) Protocol Adaptation: High Engineering Overhead. ing, bridging the long-standing specification–implementation Extending fuzzing to new ICPs necessitates the manual implementation of serialization and state management logic. gap. This is prohibitively expensive due to the proprietary nature • We integrate context-aware formalization, LLM-assisted protocol adaptation, specification-guided seed synthesis, and and diverse message formats of ICPs. Moreover, a major a specification-conformance oracle into a single coherent challenge lies in the limited observability of protocol states. pipeline, enabling the detection of subtle semantic and logic While standard protocols provide immediate feedback through explicit status fields (e.g., HTTP response codes), ICPs typically flaws beyond the reach of coverage-guided fuzzing. lack such standardized state signaling. This forces analysts • We implement and evaluate AFL-ICP on four widely deployed ICPs, outperforming state-of-the-art fuzzers and to rely on deep domain expertise to manually map message uncovering 24 new vulnerabilities, including 16 significant sequences to protocol states, a tedious process that severely semantic and logic flaws. We release the source code of hinders scalability. iii) Initial Seeds: The Diversity and Validity Deficit. HighAFL-ICP at https://github.com/susu3/AFL-ICP. quality seed corpus are crucial for maximizing fuzzing coverage II. M OTIVATION AND C HALLENGES [5], [6]. However, autonomously generating such seeds via A. Motivation: Limitations of Existing ICP Fuzzing LLMs faces a dual challenge rather than a simple trade-off. Adapting fuzzers to new ICPs mandates a labor-intensive, Without explicit grammar constraints, even advanced reasoning human-in-the-loop workflow (Fig. 1). Security analysts must models struggle to produce structurally valid packets that manually dissect voluminous specifications, hand-craft protocol strictly adhere to complex binary protocols. Simultaneously, drivers, and curate seed corpora. Only after this exhaustive models tend to converge on “typical” communication patterns, preparation can the automated fuzzing loop of testcase gen- failing to generate the diverse edge cases required to penetrate eration, execution, and feedback collection commence. Even deep program states. Consequently, direct LLM generation fails
Traditional Fuzzing Approach (Manual Bottleneck)
Protocol
Fuzzer Initial Seeds (Manual Crafting)
AFL-ICP Approach (Orchestrating Autonomous Workflows) EVOLUTION
Protocol Parser (Hand-coding) Memory Safety Bugs (Crash Only)
Protocol Parser (Coding Agent) Specification Formalization (Automated Semantic Distillation ) Initial Seeds (Auto Synthesis)
Memory Safety Bugs
Fuzzer Vulnerability Reasoning (Automated Bug Detection)
Semantic Bugs
Fig. 1. Comparison between the traditional fuzzing and the AFL-ICP method.
to produce a seed corpus that is both structurally valid and B. Specification Formalization sufficiently diverse to penetrate deep program states. Automating the interpretation of ICPs is not merely a iv) Vulnerability Reasoning: The Semantic Blind Spot. parsing task but a domain formalization challenge: transforming Current fuzzers rely on generic sanitizers [7]–[9] that are high-entropy, ambiguous natural language into low-entropy, effective for memory safety but blind to semantic deviations. executable protocol grammar. This transformation faces three Logic bugs, such as incorrect state transitions or silent packet entropic barriers: (1) Information Sparsity: The normative drops, do not trigger crashes but severely compromise protocol constraints (message formats, state machines) are often buried reliability. Manually encoding these complex rules into checkers within massive volumes of irrelevant descriptions (e.g., secreates a formalization bottleneck, as translating ambiguous curity policies and theoretical background). (2) Multimodal specification text into precise verification logic is error-prone. Fragmentation: Critical logic is often distributed across textual definitions and visual artifacts (tables, diagrams), necessitating semantic integration. (3) Ambiguity vs. Precision: Natural III. D ESIGN AND M ETHODOLOGY language specifications rely on implicit context, whereas fuzzers require explicit, machine-readable constraints. A. Overview To bridge this gap, we propose a five-stage automated To bridge the gap between abstract specifications and specification formalization pipeline. This pipeline functions concrete implementations, we present AFL-ICP, an AI-native as a knowledge distillation engine, progressively refining fuzzing architecture that transforms the traditional human- unstructured PDF data into a rigorous universal protocol dependent workflow into an autonomous, specification-driven schema. Crucially, this process also yields filtered relevant pipeline. Fig. 2 illustrates the system architecture. By systemati- documentation, a denoised, logic-dense intermediate artifact. cally integrating LLMs, AFL-ICP automates the labor-intensive Both the structured schema and this refined textual context tasks of specification analysis and seed generation, extending serve as essential inputs for subsequent seeding, adaptation, the fault detection horizon beyond simple crashes to complex and reasoning tasks. The following paragraphs detail the semantic and logic bugs. The system operates through three formalization stages. Stage 1: Context-Aware Segmentation. To accommodate cohesive phases: LLM context window constraints without sacrificing local Phase I: Autonomous Offline Preparation. AFL-ICP initisemantic coherence, we perform logic-aware segmentation. ates with a Specification Parsing pipeline (Sec. III-B) that Instead of arbitrary token chunking, which often severs critical extracts structured grammar from multimodal PDF specificross-page references, we utilize “structural anchors” (e.g., cations. Leveraging this grammar, the Protocol Adaptation Volumes, Chapters, Sections) to partition the voluminous module (Sec. III-C) synthesizes protocol-specific parsing logic, specification. We strictly align segment boundaries with natural while the Initial Seed Generation engine (Sec. III-D) constructs semantic breaks, ensuring that contextually dense units, such as a diverse, valid corpus to bootstrap the campaign—effectively large message definition tables spanning multiple pages,remain eliminating the “cold start” bottleneck of manual setups. within a single processing block. For exceptionally large Phase II: Online Fuzzing. The mutation engine executes sections ( > 50 pages), we implement secondary partitioning iterative exploration of the target state space. Distinct from traat lower-level headings to maintain processability. ditional fuzzers, it continuously logs deep semantic interactions Stage 2: Multimodal Layout Reconstruction. Standard and potential state deviations alongside standard crash signals, OCR destroys the spatial semantics essential for understanding creating a rich behavioral dataset for subsequent analysis. ICPs (e.g., bit-map diagrams). We resolve this incompatibility Phase III: Memory and Semantic Bug Reasoning. In the fithrough a dual-stream visual-textual fusion pipeline. Our nal phase, our analysis engine performs a dual-layer evaluation: methodology leverages Mistral OCR [10] to recover the it triages standard memory-safety violations and deploys the textual layer, converting PDF documents into Markdown Semantic Bug Reasoning oracle (Sec. III-E) to uncover subtle format. This process preserves the original structure, including logical non-conformances by cross-referencing execution traces chapter organization, text, and tables, while also correctly against the formal specification. placing images. Critical visual elements such as architectural The remainder of this section elaborates on the core diagrams and protocol illustrations are then processed through components of the AFL-ICP architecture. vision LLMs like GPT-4o [11], based on the insight that
Specification Formalization
Protocol Adaptation Prompt
Context-Aware Segmentation Multimodal Layout Reconstruction
Function Code
Extensive Multimodal Protocol Specification Document
Adversarial Consistency Verification J
M
Fuzzing Engine
Vulnerability Reasoning
Test Case Generation
Crashes / Hangs AFLNet-Replay
Coding Agent
Memory Safety Bug
Diversity Max
Quality Filter
Semantic and Logic Bug
Seq Generator
Refined seeds Pruned seeds
Semantic Relevance Denoising Universal Grammar Synthesis
You are an excellent software engineer. For the < protocol > protocol, refer to the specification document below and protocol grammar, output the <function name> code in C language. The Specification Document of the < protocol > protocol is as follows: Here is an example of <function name> code for HTTP protocol: === BEGIN CODE === region_t* extract_requests_http(unsigned char* buf, …){…} === END CODE === === BEGIN SPEC === <specification content> === END SPEC === ……
Msg Generator
Runtime Information
Protocol Bug
Diff Analysis
Redundant, Invalid
Initial Seed Synthesis
Protocol Grammar
Target Program
Fig. 2. Architecture of AFL-ICP: end-to-end workflow from multimodal specification formalization to LLM-assisted vulnerability reasoning.
visual constraints are indispensable for reconstructing message process faces two key challenges: what specific information to formats and state machine topology. extract and how to design a universal storage format that can Fig. 3 illustrates this multimodal document conversion accommodate diverse ICPs while remaining machine-readable. pipeline: Initial OCR conversion generates a baseline MarkChallenge 1: Information Selection (The Client-Side down representation for each PDF page. Upon figure detection Perspective). Protocol fuzzing operates as a client-side activity, (identified through pattern matching, e.g., “Figure x”), we feed sending crafted requests to trigger server vulnerabilities. This both the initial Markdown (providing essential textual context) requires a specific subset of knowledge focused on active and the corresponding image extracted from the PDF (via message construction rather than passive analysis. Therefore, PyMuPDF) to a vision LLM. The vision LLM then generates we restrict our extraction to information critical for simulating a descriptive text representation of the visual logic (e.g., state a valid client: precise field layouts for message serialization, diagrams and packet formats). The resulting textual descriptions dependency logic for valid payload construction, and state are subsequently merged into the initial Markdown, producing transition rules for navigating protocol sessions. a unified, comprehensive document suitable for subsequent Challenge 2: Universal Representation. ICPs exhibit vast LLM processing. The resulting Markdown is then input into a structural diversity (e.g., Modbus has simple frames, while text-based LLM for further processing steps. IEC104 has complex nested types). To map these heterogeneous Initial inputs into a agent-readable model, we synthesize a universal No Figures OCR Markdown protocol schema composed of three orthogonal representations: Figure Final INPUT OUTPUT PDF Detection Markdown 1) Packet Structure Specification (JSON Schema): To Image LLM capture static message definitions, we utilize JSON schema. Have Image Figures Conversion Refinement This format allows us to enforce rigid syntactic rules, detailing field sequences, data types (integer, string), endianness convenFig. 3. The Multimodal Layout Reconstruction Pipeline Stage 3: Semantic Relevance Denoising. We treat relevance tions, valid value ranges, and the hierarchical organization of filtering as a signal-to-noise problem: filtering out auxiliary headers. This provides the explicit constraint structure required noise (general introductions, physical layer specs, deployment for accurate bit-level message construction and mutation. 2) Protocol State Machine (Mermaid Notation): To capture guides) to amplify core signal (frame structures, data encoding, temporal logic, we translate client-side state transition rules and state logic). Despite their comprehensive nature, ICP into Mermaid state diagrams. This text-based diagramming specifications contain substantial content not directly pertinent language allows us to represent state definitions, transition to protocol formatting and operational rules. To replace the conditions, and event triggers (including state-dependent mestraditional, time-consuming, and error-prone manual screening sage variations) in a format that is both human-readable and process, we leverage LLMs to perform this semantic filtering. topologically parsable, guiding the generation of realistic multiWe observed that chapters relevant to protocol grammar step communication flows. often exhibit consistent terminological patterns, specifically 3) Contextual Dependencies (Structured Markdown): including keywords such as encapsulation, messages, data Complex “fuzzy” logic, such as conditional field presence flow, layering, frame, and format. We leverage this observation based on flag values, cross-field validation rules, and implicit by embedding these terminological markers into carefully behavioral requirements, often defies rigid schema definition. constructed prompts, enabling the LLM to systematically We capture these nuances by summarizing them into a identify and extract pertinent sections with high precision. structured Markdown document. This retains the semantic The content filtered in this stage establishes the foundational richness of the original natural language constraints while corpus for all subsequent processing phases. providing a clean, retrieval-ready context for the coding agent Stage 4: Universal Grammar Synthesis. This stage to handle edge cases. employs LLMs to systematically extract structured protocol grammar that serves as a reference and guide for subsequent To operationalize this multi-format storage strategy, we seed generation and vulnerability reasoning. However, this construct structured prompts that integrate the predefined
storage schemas with the filtered protocol documentation rather than maintained through implicit context. We identify from Stage 3, guiding the LLM to systematically parse the a critical insight: In ICPs, function codes are not merely protocol specifications and populate the corresponding data operation indicators but the primary carriers of protocol state— structures. The prompt design incorporates explicit formatting session lifecycle (e.g., RegisterSession / UnRegisterSession) requirements for each storage type, enabling the LLM to and data-transfer activation (e.g., STARTDT / STOPDT) are transform unstructured protocol documentation into structured both realized through function-code transitions. Therefore, we data. The extracted and standardized grammar representations implement a mapping strategy that uses function codes as can be directly utilized as a reminder or reference in subsequent state identifiers, enabling the fuzzer to maintain protocol state automated processing stages. awareness. For protocols with composite operation fields (e.g., Stage 5: Adversarial Consistency Verification. LLMs are SLMP’s command and sub-command pair), we directly sum prone to hallucinations or omissions. To mitigate this, we the two fields to derive a unified state identifier. This design implement a cross-representation verification loop that prompts naturally aligns with the inherent semantics of ICPs while the LLM to cross-reference the extracted universal grammar maintaining compatibility with existing state-based fuzzing against the filtered source documentation rather than relying mechanisms. on unaided self-reflection. This stage implements a systematic Coding Agent. Our approach employs a SOTA coding agent verification process that performs secondary validation of the (e.g., Claude Code) to generate protocol support code via a protocol grammar extracted in Stage 4. We construct structured structured prompt engineering methodology. We construct comvalidation prompts that embed the generated text descriptions, prehensive prompts that integrate three essential components: JSON schemas, and Mermaid diagrams alongside the filtered (1) existing protocol support code templates that demonstrate protocol documentation from Stage 3 (in Markdown format), the required code structure and API interfaces, (2) the extracted instructing the LLM to perform cross-referential consistency protocol grammar from Stage 4, including JSON schemas, checking. state machine descriptions, and field dependencies, and (3) Specifically, for JSON Schemas, the LLM scrutinizes syntac- the filtered protocol documentation from Stage 3 to provide tic and semantic correctness, identifying discrepancies in field additional contextual information. The coding agent receives definitions, data types, and dependencies against the source doc- these inputs and generates protocol-specific parsing code that umentation. Similarly, for Mermaid state machines, it verifies conforms to the established code patterns while implementing topological consistency by cross-referencing state transitions the target protocol’s unique characteristics. and event triggers. When inconsistencies are detected, the LLM Automated Verification and Refinement. To ensure the generates detailed diagnostic reports specifying the exact field reliability of the generated code without human intervention, locations, nature of errors, and suggested corrections. we deploy two specialized agents. First, the code review agent Upon error detection, we re-invoke the LLM with the performs static analysis on the generated code. It checks for diagnostic feedback to regenerate corrected representations. compliance with coding standards, potential logic errors, and This adversarial loop enables systematic error detection and security vulnerabilities (e.g., buffer overflows in the parsing correction across all storage formats, demonstrating measurable logic itself). Second, the integration test agent dynamically validates the code. It attempts to compile the new ICP adapter improvements in extraction accuracy. and link it with the core fuzzing engine. Upon successful C. Protocol Adaptation compilation, it runs the fuzzer against a small set of valid Adapting stateful fuzzers to binary ICPs necessitates bridging seeds to verify basic functional correctness (e.g., successfully the gap between raw byte streams and structured protocol parsing a valid packet without crashing). If either agent detects semantics. For instance, adapting an AFLNet-style stateful an issue, detailed feedback is automatically fed back to the fuzzer requires the agent to generate two protocol-specific coding agent. The coding agent then analyzes the feedback, functions: one that delimits message boundaries within the revises the code, and resubmits it for verification. This iterative request byte stream, and one that extracts the state identifier self-correction loop continues until the protocol adapter passes from server responses. To automate this, we introduce a fully all checks, achieving a fully autonomous generation pipeline. automated protocol adaptation methodology driven by a multiagent system. This pipeline coordinates a coding agent to D. Initial Seed Synthesis synthesize parsing logic, with code review and integration test It is widely recognized that initial seed corpus quality agents that iteratively validate and refine the generated code, significantly impacts fuzzing’s effectiveness [5], [6]. Highensuring a robust and autonomous adaptation process. quality seeds encompass diverse input formats of the tested Function Code as State Identifier. A key challenge in protocol, enabling the fuzzing tools to rapidly explore deeper adapting fuzzers to ICPs lies in state management, as most and broader code paths, thus improving overall test coverage. fuzzing tools rely on state codes to track protocol execution Moreover, carefully selected seeds reduce the learning overhead states and guide mutation strategies. ICPs are characterized by for fuzzers, facilitate the efficient construction of protocol state an operation-centric design philosophy: their state transitions machines, and help generate valid, protocol-conformant mutated are encoded directly in the operation type of each message— packets. Motivated by the generative capabilities of LLMs, we typically expressed as function codes or command codes— propose an automated pipeline to synthesize the seed corpus.
Generating effective seeds via LLMs faces a dual deficit in validity and diversity. Without explicit constraints, models struggle to produce structurally valid packets for complex protocols, while simultaneously converging on repetitive patterns that miss critical edge cases. To address this challenge, we implement a two-stage seed generation methodology that decouples diversity maximization from quality assurance. The first stage focuses on diversity maximization. We perform multiple queries to generate a broad spectrum of seed candidates. To guide this generation, our prompts synthesize two primary information sources: (1) the extracted universal protocol schema (grammar constraints), and (2) the filtered relevant documentation (semantic context). Additionally, if pre-captured network traffic is available, it can be included as few-shot examples. This combination allows the model to produce seeds that mirror authentic communication patterns while maintaining the randomness for fuzzing. The second stage acts as a quality filter. We utilize standard seed optimization tools (e.g., afl-tmin) to prune the raw generated corpus. This step eliminates redundant, invalid, or oversized seeds, retaining only a compact set of high-quality inputs. By effectively separating the “creative” generation phase from the “restrictive” validation phase, we achieve a final seed corpus that simultaneously ensures high structural diversity and strict protocol compliance. Within this two-stage framework, we synthesize seeds at two distinct granularities: message-level seeds and sequence-level seeds. Message-level seeds consist of individual protocol packets that test specific protocol features and edge cases. Sequencelevel seeds comprise multi-packet communication flows that exercise protocol state transitions and complex interaction patterns. To facilitate automated extraction, we enforce structured XML-like output formats via prompt constraints: messagelevel seeds are enclosed in <sequence> tags (treated as single-step sequences), while sequence-level seeds use nested structures as follows: <sequence><message>... </message>...</sequence>. For sequence generation, our approach explicitly instructs the LLM to first traverse a valid execution path on the protocol state machine, then systematically populate each packet in the identified path with appropriate field values. This structured generation ensures that the resulting sequences strictly adhere to the state machine topology, guaranteeing logical continuity between consecutive messages. E. Semantic Vulnerability Reasoning While existing sanitizers effectively capture memory safety violations, they remain blind to semantic vulnerabilities where implementations deviate from protocol rules without crashing. To detect these deep logic bugs, we introduce specificationimplementation differential analysis. Unlike traditional differential testing, which compares the outputs of two software binaries, our approach treats the protocol specification itself as the absolute “golden standard”. We propose a specificationconformance oracle that leverages LLMs to directly crossreference the fuzzer’s interaction history (both request and
response packets) against the formal requirements defined in the specification. We employ a dual-layer vulnerability detection strategy: utilizing traditional sanitizers for memory safety bugs while deploying our specification-conformance oracle for semantic and logic bugs. When the implementation’s behavior contradicts the formal definition, the oracle flags the discrepancy. To ensure comprehensive coverage, our oracle operates on two distinct recording mechanisms: Path-Triggered Recording. When a new execution path is discovered, we capture the complete communication history. This allows us to verify conformance for every unique functional state reached by the fuzzer, ensuring that new logic paths adhere to specification constraints. Probabilistic Sampling. Logic bugs often manifest in paths already explored (e.g., incorrect error codes) without triggering new coverage. To capture these, we employ a probabilistic sampling strategy that periodically records test cases regardless of coverage gain, ensuring that “silent” logic violations do not escape detection. Invoking LLMs for real-time bug analysis during fuzzing would significantly slow down the testing process, we adopt a record-then-check approach to maintain fuzzing efficiency. During the fuzzing phase, we only record test cases and their execution traces; after fuzzing terminates, we invoke the LLM-enabled specification-conformance oracle to analyze all recorded test cases in batch. This deferred analysis strategy ensures that fuzzing throughput remains unaffected while still leveraging the power of LLMs for semantic bug detection. Concretely, each recorded test case—comprising the request packet and the corresponding server response—is provided to the LLM together with the relevant specification context (the filtered Markdown documentation from Stage 3 and the structured grammar from Stage 4). The prompt instructs the LLM to flag any behavioral deviation and to ground each flagged finding in a specific specification clause; requiring this explicit clause citation discourages ungrounded hallucinations. Any residual false positives are caught by the manual validation pipeline described in Sec. V-B5. IV. I MPLEMENTATION We have implemented a prototype of AFL-ICP based on AFLNet, a state-of-the-art state-guided greybox fuzzer for network protocols. Our implementation consists of over 6,000 lines of code. The core fuzzing components are written in C and integrated directly into AFLNet, while the Stage 1-3 of specification formalization modules are implemented in Python. LLM Integration. We strategically employ different LLMs based on their architectural strengths. For the multimodal layout reconstruction task (Sec. III-B Stage 2), we utilize GPT-4o due to its superior vision-language capabilities in interpreting complex diagrams. For protocol adaptation (Sec. III-C), the coding agent is instantiated with Claude Code, which provides agentic code generation, review, and execution feedback in a single loop. For all other text-centric tasks, including semantic
relevance denoising, universal grammar synthesis, seed synthesis, and bug reasoning, we employ Gemini-2.5-Pro, leveraging its extensive context window and reasoning performance. All interactions are managed through their respective native APIs with robust error handling and retry mechanisms. The pipeline is intentionally model-agnostic: each stage prescribes a capability requirement rather than a specific vendor. The proprietary models above were chosen for their leading capability at the time of evaluation, but any model that meets the corresponding capability bar can be substituted in principle. We further note that LLM invocations are confined to the offline preparation and post-campaign analysis stages; the online fuzzing loop itself involves no LLM calls. Document Processing. Our specification formalization pipeline integrates multiple tools to handle complex PDF documents. We employ Mistral OCR for converting PDF pages into Markdown format. We utilize PyMuPDF (also known as fitz) to extract embedded artifacts for the vision LLM pipeline. These components work synergistically to transform unstructured PDF specifications into final Markdown. Fuzzing Infrastructure Enhancement. To facilitate the twostage seed generation (Sec. III-D), we integrated afl-tmin into our pipeline for automated corpus quality filter. For semantic bug reasoning (Sec. III-E), we implemented a lightweight trace logger within AFLNet’s main loop that records requestresponse pairs to disk for post-campaign batch analysis, so that no LLM invocation occurs inside the fuzzing loop. Protocol Support. We have extended AFLNet to support four widely-used ICPs: Modbus TCP, EtherNet/IP, IEC 104, and SLMP. For each protocol, our coding agent successfully synthesized protocol-specific message parsers, state machine handlers, and response validators. The generated support code integrates seamlessly with AFLNet’s existing infrastructure, enabling state-guided mutation and coverage tracking for these binary ICPs. V. E VALUATION To evaluate the effectiveness of AFL-ICP, we try to answer the following questions: Q1. State Coverage. Does AFL-ICP explore more protocol states compared to baselines? Q2. Code Coverage. How much more code coverage does AFL-ICP achieve compared to the baseline? Q3. Ablation Study. What is the impact of the each component on the performance of AFL-ICP? Q4. Bug Identification. Can AFL-ICP detect previously unknown memory safety and semantic and logic bugs? A. Experimental Design Target Programs. To evaluate AFL-ICP, we conducted experiments on seven mature implementations across four widely used ICPs: libmodbus and libplctag for Modbus TCP; OpENer and EIPScanner for EtherNet/IP; FreyrSCADA and IEC104 for IEC 104; and libslmp2 for SLMP. These implementations are widely used both in enterprises and individual users. Some implementations can be directly used as test subjects without
modification, while others require additional components to construct a testable environment. For example, EIPScanner [12] is a client-side library and cannot be evaluated independently; therefore, we implemented a server-side program that reuses its protocol parsing and handling logic, enabling effective evaluation within our testing framework. Baselines. We compare AFL-ICP against two state-of-theart open-source fuzzers: AFLNet [2] (a mutation-based, stateguided fuzzer) and ChatAFL [4] (an LLM-guided fuzzer). Since neither tool natively supports ICPs, we extend both with the same protocol adapter code generated by our coding agent, ensuring all three fuzzers operate on identical protocol parsing logic so that any coverage difference reflects the fuzzing strategy rather than harness quality. Both baselines were configured with optimal parameters to ensure a fair comparison. We note that prior ICP-specific fuzzers such as Polar [13] and related works [14], [15] are not included as baselines because their source code is not publicly available, precluding direct empirical comparison. Evaluation Methodology. We evaluate effectiveness based on both coverage and vulnerability discovery. For coverage, we report the coverage of both the code and the state space. Code coverage (branch and line) is measured using gcovr [16], with the exception of FreyrSCADA [17] whose core logic resides in a closed-source precompiled library libx86_x64-iec014.a. State-space coverage is quantified by (1) state coverage, representing the number of distinct protocol states explored, and (2) transition coverage, reflecting the diversity of state transition paths exercised. Both are extracted from the fuzzer’s n_nodes and n_edges outputs. To ensure statistical significance and mitigate the impact of non-determinism, all results are averaged over five independent 24-hour repetitions, with outliers excluded from the final calculation. Memory safety vulnerabilities are identified using ASAN [8]. Crash-inducing sequences are reproduced via AFLNet-replay for root-cause analysis, and unique bugs are distinguished through stack trace analysis. Furthermore, we identify semantic and logic vulnerabilities by utilizing our reasoning engine to flag behavioral deviations from protocol specifications for subsequent verification. Experimental Environment. All experiments were conducted on a server running Ubuntu 20.04.6 LTS, equipped with a 28-core CPU and 32GB of RAM. B. Experimental Results 1) State-space Coverage: Table I details the state and transition coverage. Overall, AFL-ICP consistently outperforms baselines, achieving average improvements of 46.15%/53.29% in state coverage and 64.41%/64.42% in transition coverage compared to AFLNet and ChatAFL, respectively. State Coverage. AFL-ICP excels in deep state exploration, particularly in FreyrSCADA, where it achieves a 196% improvement. FreyrSCADA is closed-source and uninstrumentable; traditional fuzzers fail to efficiently guide the generation of valid sequences. AFL-ICP overcomes this by initializing campaigns with offline-synthesized, specification-compliant
TABLE I C OMPARISON OF AVERAGE STATE AND TRANSITION COVERAGE BETWEEN AFL-ICP AND BASELINES .
Program libmodbus libplctag OpENer EIPScanner FreyrSCADA IEC104 libslmp2 AVG
AFL-ICP State Transition 23.60 220.40 46.20 422.40 65.40 276.60 13.20 14.40 14.80 23.40 7.60 6.60 1.00 1.00
State 20.60 39.00 54.20 9.00 5.00 6.00 1.00
AFLNet Improve Transition 14.56% 154.80 18.46% 371.20 20.66% 236.20 46.67% 8.00 196.00% 6.40 26.67% 5.00 0.00% 1.00 46.15%
Improve 42.38% 13.79% 17.10% 80.00% 265.63% 32.00% 0.00% 64.41%
State 22.60 42.40 33.80 9.20 5.00 6.00 1.00
ChatAFL Improve Transition 4.42% 209.20 8.96% 411.60 93.49% 153.00 43.48% 8.20 196.00% 6.60 26.67% 5.00 0.00% 1.00 53.29%
Improve 5.35% 2.62% 80.78% 75.61% 254.55% 32.00% 0.00% 64.42%
TABLE II C OMPARISON OF AVERAGE BRANCH AND LINE COVERAGE BETWEEN AFL-ICP AND BASELINES .
Program libmodbus libplctag OpENer EIPScanner IEC104 libslmp2 AVG
AFL-ICP Line Branch 477.60 216.00 671.00 307.00 1412.00 371.00 198.00 137.00 351.40 80.00 683.25 303.00
Line 457.60 671.00 1175.00 180.00 254.80 659.00
AFLNet Improve Branch 4.37% 198.40 0.00% 307.00 20.17% 301.60 10.00% 121.80 37.91% 61.40 3.68% 283.00 12.69%
Improve 8.87% 0.00% 23.01% 12.48% 30.29% 7.07% 13.62%
Line 475.00 671.00 1179.80 177.60 250.20 670.00
ChatAFL Improve Branch 0.55% 215.60 0.00% 307.00 19.68% 303.60 11.49% 117.40 40.45% 61.60 1.98% 291.80 12.36%
Improve 0.19% 0.00% 22.20% 16.70% 29.87% 3.84% 12.13%
seeds that directly penetrate deep states. In contrast, ChatAFL degradation of ChatAFL compared to the baseline AFLNet occasionally degrades (e.g., in OpENer) as general LLMs lack in EIPScanner and IEC104 likely stems from the stochastic detailed knowledge of ICPs and thus misguide state exploration. nature of greybox fuzzing rather than an algorithmic deficiency, Note that absolute state counts vary by protocol complexity as the differences in covered lines are negligible. and implementation details, yet even for the extensively Branch Coverage. AFL-ICP reaches deeper logic by using fuzzed libmodbus, AFL-ICP still uncovers 14.56% more states, valid seeds to bypass gated checks. Notably, a “State-Code confirming its ability to reach deep-seated logic. Paradox” appears in OpENer: ChatAFL achieves slightly Transition Coverage. AFL-ICP demonstrates even greater higher branch coverage than AFLNet despite significantly advantages in transition coverage, achieving a 265.63% im- lower state coverage. This indicates that ChatAFL’s mutations provement in FreyrSCADA. This is primarily because AFL-ICP trigger shallow error-handling branches but fail to maintain the overcomes the “initial handshake barrier”: by seeding the fuzzer complex session states required for deep protocol exploration. with valid handshake sequences derived from specifications, it AFL-ICP effectively overcomes this limitation. immediately reaches core protocol logic, whereas traditional 3) Ablation Study: To evaluate the individual contributions fuzzers waste hours mutating packets just to pass the first of each component, we conducted an ablation study focusing on validation check. Consequently, it exercises deep logic paths coverage improvements. Note that protocol adaptation provides that remain unreachable to blind mutation. Note that simple the necessary execution environment, while semantic vulneraICPs like libslmp2 show a saturation effect, where limited bility reasoning focuses on vulnerability identification; neither logical density leaves no room for further optimization. directly influences coverage. Therefore, we specifically measure 2) Code Coverage.: Table II details the branch and line the coverage gains driven by specification formalization and coverage. Overall, AFL-ICP consistently outperforms baselines, initial seed synthesis using four incremental configurations: A1: AFLNet (Baseline). Standard AFLNet adapted for ICPs, achieving average improvements of 12.69%/12.36% in line coverage and 13.62%/12.13% in branch coverage compared without any LLM enhancements. This serves as our baseline. A2: A1 + LLM-based Seed Generation (No Specification). to AFLNet and ChatAFL, respectively. Note that coverage for some targets (e.g., libplctag) hits a plateau because the provided Adds LLM-based seed synthesis using only protocol names test harnesses only expose limited functional interfaces, leaving and pre-trained knowledge, testing baseline LLM capability. large portions of the library unreachable regardless of fuzzer A3: A1 + Simple Document Preprocessing + Initial efficiency. Seed Synthesis. LLMs generate seeds guided by specifications Line Coverage. AFL-ICP shows significant gains where processed through basic PDF-to-text conversion (PyPDF2). This harnesses provide broader reach, such as in OpENer and evaluates the impact of raw text lacking structural context. IEC104, where it achieves improvements of 20.17% and 37.91% A4: A1 + Specification Formalization + Initial Seed over AFLNet, respectively. Notably, the marginal performance Synthesis (Full AFL-ICP). Integrates complete components.
4.0
A3 A4 (AFL-ICP)
+196.00%
2.5 2.0 1.5 1.0
+14.56% +18.46% +20.66%
+48.89%
+26.67%
0.00%
0.5 0.0
A1 A2
3.5
A3 A4 (AFL-ICP)
+265.62%
1.6
3.0 2.5 2.0 1.5
+80.00% +42.38%
1.0
+13.79% +17.10%
+32.00%
0.00%
0.5 dbus bplctag OpENer Scanner eyrSCADA IEC104 li libmo EIP Fr
0.0
p2 libslm
Normalized Coverage
3.0
A1 A2
Normalized Coverage
Normalized Coverage
3.5
1.4 1.2 1.0
A1 A2
A3 A4 (AFL-ICP)
+37.91%
+20.17% +4.37%
0.00%
+10.00%
+3.68%
0.8 0.6 0.4 0.2
dbus bplctag OpENer Scanner eyrSCADA IEC104 li libmo EIP Fr
p2 libslm
0.0
dbus libmo
ag
t libplc
er OpEN
EIPSc
anne
r
IEC10
4
p2
libslm
(a) State Coverage (b) Transition Coverage (c) Line Coverage Fig. 4. Ablation study results showing state, transition, and line coverage improvements.
Normalized Coverage
1.6 1.4
A1 A2
1.2
+8.87%
1.0
A3 A4 (AFL-ICP)
+23.01%
0.00%
+30.29% +12.48%
+7.07%
0.8 0.6 0.4 0.2 0.0
bus
d libmo
tag
libplc
er OpEN
r anne
EIPSc
4
IEC10
p2 libslm
Fig. 5. Ablation study results showing branch coverage improvements
The structured ICP knowledge guides the LLM to generate highquality seeds, demonstrating the full potential of specificationguided fuzzing. This design allows us to evaluate: (1) the contribution of LLM-based seed generation alone (A2 vs. A1), (2) the impact of basic document guidance (A3 vs. A2), (3) the added value of structured specification parsing over simple document conversion (A4 vs. A3), and (4) the overall improvement of the complete system (A4 vs. A1). Fig. 4 and Fig. 5 jointly summarize the results of the ablation study. In these figures, we present the normalized coverage, where the A1 (Baseline) is set to 1.0. Analysis of State-Space Exploration. Fig. 4a and Fig. 4b show that while the full configuration (A4) consistently excels, ablated configurations (A2, A3) fluctuate, particularly in OpENer and IEC104. This instability stems from imprecise guidance: A2 suffers from imprecise guidance driven by general LLMs, while A3 struggles with conflicting constraints from unstructured text. Although minor variations reflect the stochastic nature of fuzzing, A4’s robust performance confirms that specification guidance and structured parsing are needed to reliably navigate complex ICPs. Analysis of Code Coverage. Fig. 4c and Fig. 5 further expose the counterproductive effects of unguided LLMs. Specifically, A2 causes a sharp regression in libslmp2, where hallucinations produce invalid seeds that fail basic parsing. Additionally, identical results for libplctag across all stages confirm the “test harness saturation” noted in Sec. V-B2. The progression from A3 to A4 demonstrates that only by accurately capturing critical protocol fields via our multimodal pipeline can the LLM generate high-quality seeds that penetrate deep functional logic. 4) Memory Safety Bug Detection: Table III reports the unique crash-inducing sequences discovered across five cam-
paigns. AFL-ICP discovered 87 unique sequences, outperforming AFLNet (49, +77.6%) and ChatAFL (38, +129.0%). Detailed analysis confirmed eight distinct memory safety vulnerabilities, summarized in Table IV. In FreyrSCADA, we identified memory leaks. Although its closed-source nature prevented precise root cause analysis, the bug has been officially acknowledged by the vendor. For EIPScanner, AFL-ICP and AFLNet found all three heap buffer over-read bugs, while ChatAFL found only one. Notably, in IEC104, AFL-ICP uniquely discovered three null pointer dereference and DoS vulnerabilities, compared to only one by baselines. Furthermore, AFL-ICP exclusively triggered a heap buffer over-read in libslmp2 (ID 8), which remained undetected by others. These findings validate that AFL-ICP’s specification-guided strategy enables deeper state exploration, uncovering vulnerabilities inaccessible to existing fuzzers. 5) Semantic and Logic Bug Detection: We evaluate AFLICP’s capability to detect semantic deviations, categorized into three types: (1) Strict Non-Conformance (SNC), where the implementation explicitly contradicts protocol rules; (2) Fragile Error Handling (FEH), where the implementation adopts unsafe practices in ambiguous specification definition scenarios; (3) Implementation Logic Flaws (ILF), where fundamental code logic errors cause functional deviations. Through our analysis, we uncovered multiple vulnerabilities (Table V). To rule out LLM hallucinations, each flagged finding was validated by (1) replaying the request sequence to reproduce the deviant behavior on the target implementation, (2) locating the specific clause in the original protocol specification that the behavior violates, and (3) reporting the issue to upstream maintainers where applicable. SNC. Violations of explicit protocol rules often undermine security boundaries. For instance, in libmodbus (Bug 1), the server processes packets with invalid Protocol IDs instead of discarding them. This violation of the “filter-at-header” principle allows malicious packets to potentially bypass firewalls or DPI systems. Similarly, in OpENer (Bug 8), the server erroneously replies to requests with non-zero status fields, exposing a sidechannel for attackers to enumerate valid session handles. FEH. Unsafe practices in edge cases can lead to resource exhaustion. A critical example is found (Bug 4), where the server lacks application-layer timeouts when reading the header. Attackers can exploit this by establishing numerous connections that send incomplete headers, launching a Slowloris-style DoS
TABLE III U NIQUE CRASH - INDUCING SEQUENCES DISCOVERED .
Program AFL-ICP AFLNet Improve ChatAFL Improve libmodbus 0 0 0.00% 0 0.00% libplctag 0 0 0.00% 0 0.00% OpENer 0 0 0.00% 0 0.00% 49 25 96.00% 10 390.00% EIPScanner FreyrSCADA 30 21 42.86% 27 11.11% IEC104 7 3 133.33% 1 600.00% libslmp2 1 0 0 Total 87 49 77.55% 38 128.95%
attack that indefinitely occupies server threads. ILF. Fundamental logic errors often result in functional deviations. In libslmp2 (Bug 14), the implementation incorrectly treats stream-oriented TCP as message-oriented. It parses only the first frame in a received buffer and discards the rest, causing data loss when TCP stickiness occurs. Additionally, in libmodbus (Bug 2), implicit length reliance causes desynchronization, allowing attackers to inject “ghost commands” hidden within residual TCP data. These discoveries highlight that subtle semantic deviations, often overlooked by traditional crash-based fuzzers, can be effectively identified through AFL-ICP. VI. R ELATED W ORK Fuzzing for ICPs. Traditional ICP fuzzers, such as Polar [13] and other specialized ICP fuzzers [14], [15], rely on functioncode awareness or traffic-based state machine inference. However, these methods struggle to explore deep logic paths that are defined in specifications but absent from the initial seed traffic. In contrast, AFL-ICP overcomes the semantic blindness by directly leveraging authoritative knowledge extracted from protocol specifications. Knowledge-Driven Fuzzing. Existing works attempt to incorporate knowledge through manual formalization or automated inference. For instance, Sun et al. [18] and TCPFuzz [19] extract semantics from network traffic, inherently limiting their scope to observable behaviors. While ProphetFuzz [20] employs simplified parsing unsuitable for the complexity of multi-modal ICP specifications. AFL-ICP bridges this gap by automating the transformation of unstructured, multi-modal documentation into executable models, effectively eliminating the formalization bottleneck. Specification-Centric Security Analysis. A complementary line of work analyzes protocol specifications themselves rather than implementations. CellularLint [21], for example, applies NLP techniques to detect internal inconsistencies within 4G/5G cellular standards. Such efforts target the specification-vsspecification axis and produce findings about the document, whereas AFL-ICP targets the specification-vs-implementation axis and operationalizes specifications as the ground truth that drives end-to-end fuzzing and conformance checking of ICP implementations. LLM-Guided Protocol Fuzzing. Recent research utilizes LLMs for seed generation [4], mutation [22], and complex input synthesis [23]. However, tools like ChatAFL [4] primarily use LLMs as auxiliary mutation engines, often lacking the precision required for specialized ICS protocols. AFL-ICP advances this
paradigm by integrating LLMs as a core “architect” throughout the entire fuzzing lifecycle, ensuring both semantic correctness and deep state exploration. VII. C ONCLUSION In this paper, we presented AFL-ICP, an AI-native fuzzing framework that bridges the critical gap between abstract protocol specifications and concrete implementations in ICPs. By automating the transformation of unstructured, multimodal specifications into a rigorous unified protocol schema, AFLICP overcomes the specification-blindness and the manual formalization bottleneck. Our approach systematically integrates LLMs into every phase of the workflow, effectively transforming fuzzing from a blind stochastic search into a specification-guided process. Extensive evaluations demonstrate that AFL-ICP significantly outperforms state-of-the-art fuzzers in coverage and uncovers 24 previously unknown vulnerabilities, including 16 semantic and logic bugs. R EFERENCES [1] S. D. D. Anton, D. Fraunholz, D. Krohmer, D. Reti, D. Schneider, and H. D. Schotten, “The global state of security in industrial control systems: An empirical analysis of vulnerabilities around the world,” IoTJ, 2021. [2] V.-T. Pham, M. Böhme, and A. Roychoudhury, “Aflnet: a greybox fuzzer for network protocols,” in ICST, 2020. [3] R. Natella, “Stateafl: Greybox fuzzing for stateful network servers,” Empirical Software Engineering, 2022. [4] R. Meng, M. Mirchev, M. Böhme, and A. Roychoudhury, “Large language model guided protocol fuzzing,” in NDSS, 2024. [5] G. Klees, A. Ruef, B. Cooper, S. Wei, and M. Hicks, “Evaluating fuzz testing,” in SIGSAC, 2018. [6] A. Herrera, H. Gunadi, S. Magrath, M. Norrish, M. Payer, and A. L. Hosking, “Seed selection for successful fuzzing,” in ISSTA, 2021. [7] T. C. Projects, “Undefined behavior sanitizer for chromium,” Website. http://www.chromium.org/developers/testing/undefinedbehaviorsanitizer, 2014. [8] K. Serebryany, D. Bruening, A. Potapenko, and D. Vyukov, “{AddressSanitizer}: A fast address sanity checker,” in USENIX ATC, 2012. [9] D. Song, J. Lettner, P. Rajasekaran, Y. Na, S. Volckaert, P. Larsen, and M. Franz, “Sok: Sanitizing for security,” in S&P, 2019. [10] Mistral AI, “Mistral OCR,” https://mistral.ai, 2025, accessed: 2025-03-12. [11] OpenAI, “Hello GPT-4o,” 2024, accessed: 2025-03-12. [Online]. Available: https://openai.com/index/hello-gpt-4o/ [12] A. R. Aleksy Timin, “Eipscanner,” Website. https://github.com/ nimbuscontrols/EIPScanner. [13] Z. Luo, F. Zuo, Y. Jiang, J. Gao, X. Jiao, and J. Sun, “Polar: Function code aware fuzz testing of ics protocol,” TECS, 2019. [14] Z. Luo, F. Zuo, Y. Shen, X. Jiao, W. Chang, and Y. Jiang, “Ics protocol fuzzing: Coverage guided packet crack and generation,” in DAC, 2020. [15] F. Zuo, Z. Luo, J. Yu, T. Chen, Z. Xu, A. Cui, and Y. Jiang, “Vulnerability detection of ics protocols via cross-state fuzzing,” TCAD, 2022. [16] Gcovr Developers, “Gcovr: A report generator for gcc’s gcov,” https: //gcovr.com/en/stable/, version 8.4, accessed September 2025. [17] F. E. Solution, “Iec-60870-5-104,” Website. https://github.com/ FreyrSCADA/IEC-60870-5-104. [18] Y. Sun, S. Lv, J. You, Y. Sun, X. Chen, Y. Zheng, and L. Sun, “Ipspex: Enabling efficient fuzzing via specification extraction on ics protocol,” in ACANC, 2022. [19] Y.-H. Zou, J.-J. Bai, J. Zhou, J. Tan, C. Qin, and S.-M. Hu, “{TCP-Fuzz}: Detecting memory and semantic bugs in {TCP} stacks with fuzzing,” in USENIX ATC 21, 2021. [20] D. Wang, G. Zhou, L. Chen, D. Li, and Y. Miao, “Prophetfuzz: Fully automated prediction and fuzzing of high-risk option combinations with only documentation via large language model,” in SIGSAC, 2024. [21] M. M. Rahman, I. Karim, and E. Bertino, “Cellularlint: A systematic approach to identify inconsistent behavior in cellular network specifications,” in USENIX Security, 2024.
TABLE IV S UMMARY OF MEMORY SAFETY VULNERABILITIES DISCOVERED BY AFL-ICP
ID 1 2 3 4 5 6 7 8
Subject FreyrSCADA IEC104 IEC104 IEC104 EIPScanner EIPScanner EIPScanner libslmp2
Version V21.06.008-89-g917706d be6d841 be6d841 be6d841 1.3.0-33-g12c89a5 1.3.0-33-g12c89a5 1.3.0-33-g12c89a5 v1.0.0
Memory Safety Bug Description Memory leaks after memory copying Firmware Backoff: Null pointer dereference (Iec104.c: 1214) Firmware Update: Null pointer dereference (Iec104.c: 1129) Denial of service due to the data finish error (clock nanosleep.c: 78) Heap buffer over-read via unchecked vector size in bulk data copy (Buffer.cpp: 146) Heap buffer over-read when reading low byte of uint16 t (Buffer.cpp: 51) Heap buffer over-read when reading high byte of uint16 t (Buffer.cpp: 52) Heap buffer over-read via unchecked Number of loopback data field (svrskel.c: 76)
TABLE V S UMMARY OF SEMANTIC AND LOGIC VULNERABILITIES DISCOVERED BY AFL-ICP. C ATEGORIES : S TRICT N ON -C ONFORMANCE (SNC), F RAGILE E RROR H ANDLING (FEH), AND I MPLEMENTATION L OGIC F LAWS (ILF).
ID 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16
Subject libmodbus libmodbus libmodbus libplctag IEC104 IEC104 IEC104 OpENer EIPScanner EIPScanner EIPScanner EIPScanner libslmp2 libslmp2 libslmp2 libslmp2
Version v3.1.10-6-g5c14f13 v3.1.10-6-g5c14f13 v3.1.10-6-g5c14f13 v2.6.12-0-gdeccfa3 be6d841 be6d841 be6d841 v2.3-573-g4aa166a 1.3.0-33-g12c89a5 1.3.0-33-g12c89a5 1.3.0-33-g12c89a5 1.3.0-33-g12c89a5 v1.0.0 v1.0.0 v1.0.0 v1.0.0
Cat. SNC SNC FEH FEH SNC SNC SNC SNC FEH ILF SNC SNC SNC SNC ILF FEH
Semantic and Logic Bug Description Packets with invalid Protocol Identifier not discarded Packet boundary identified by implicit function code byte count instead of explicit length field Blocks and disconnects on payload mismatch instead of sending Exception code. Server blocks indefinitely on incomplete MBAP headers, causing resource exhaustion. Violation of state machine logic, accepts I-frames without STARTDT activation Failure to validate APDU length before processing leads to out-of-bounds memory access Incomplete protocol implementation fails to support fundamental monitoring ASDUs Replies to requests containing a non-zero status field, violating the no-reply requirement Responds to truncated packets with fabricated fields due to missing header length validation. SendRRData packet construction errors and failure to validate malformed request packets Replies to invalid UnRegisterSession packets, violating the no-reply requirement Returns SUCCESS for requests with non-zero Options field instead of discarding. Silently discards unsupported commands without error information in response. Response header contains mismatching Serial No. Only parses the first frame in a received TCP buffer and silently discards the remaining data. Returns success for Loopback Test despite mismatch between data count and actual payload.
[22] C. S. Xia, M. Paltenghi, J. Le Tian, M. Pradel, and L. Zhang, “Fuzz4all: Universal fuzzing with large language models,” in ICSE, 2024. [23] C. Yang, Z. Zhao, and L. Zhang, “Kernelgpt: Enhanced kernel fuzzing via large language models,” in ASPLOS, 2025.