2025 · Conference paper
Unleashing the Power of LLM to Infer State Machine From the Protocol Implementation
ProtocolGPT infers protocol state machines from implementation source code with a retrieval-augmented LLM. It extracts state-machine-related code with regular expressions and a code filter, splits it into syntax-aware chunks stored in a FAISS vector store with OpenAI embeddings, and prompts GPT-4 step by step to recover states and message-triggered transitions. On six protocols in five open-source code bases (IKEv2, TLS 1.3, TLS 1.2, BGP, RTSP and L2TP), the authors report transition precision above 90%, more than 30% higher precision and 55% higher recall than baselines. Seeding AFLNet with the inferred machines raised coverage by more than 20% and found two previously unknown crash bugs in an RTSP server.
Scope and limitations
Requires source code; it does not work from binaries or traffic alone. Each implementation was chosen for explicitly defined states, and results cover only the six evaluated protocols, two of which share the s2n-tls code base. Ground truth was built manually by three experts from repository code; precision and recall count only fully correct transitions. RFCNLP had higher precision on RTSP. Results depend on GPT-4 at temperature 0.2 through a commercial API, so outputs and costs may change. The inferred machines are LLM summaries, not proofs of implementation behavior or equivalence. Fuzzing gains come from AFLNet seeds; BGP's event-driven transitions limited message-based coverage. The two crash bugs are in the feng RTSP server.
Why it fits this collection
Adds LLM-based protocol state-machine recovery from implementation source code, complementing the collection's traffic-based, binary-assisted and grey-box state inference research.
Publication and review details
- Venue
- IWQoS 2025
- Status
- Conference paper
- Publication / posting date
- 2025 (exact date not verified)
- Date source
- The publisher's Crossref deposit establishes publication year 2025. Its print date of 2 July 2025 is also the first day of the July 2–4 symposium recorded in the same deposit, and IEEE Xplore could not be retrieved automatically to confirm a publication day, so no finer date is asserted.
- First arXiv submission
- May 1, 2024
- arXiv
- 2405.00393
- Reviewed arXiv version
- v4
- DOI
- 10.1109/IWQoS65803.2025.11143461
Crossref establishes the ten-author order, the IWQoS 2025 proceedings, pages 1–10 and the DOI; the IEEE title capitalizes “From”, while arXiv uses “from”. arXiv v4 of 2025-03-27 (v1 2024-05-01) has no journal reference or venue comment. Its benchmark pins strongSwan f994e0a, s2n-tls 025f3b2, openbgpd 08b59c1, feng d302a1c and openl2tp be6c288; the experiments ran GPT-4 on a 32 GB i7-12700 Ubuntu 20.04 machine. That version says source code and experimental data would be released after acceptance; neither arXiv nor the paper links a release. A GitHub repository, s1awwhy/ProtocolGPT, uses the paper title and contains Python scripts, but has no license and is not linked by the paper. The developer is reported to have confirmed the two RTSP bugs; no CVE identifiers are given.
Sources reviewed
Reviewed against the paper and its primary sources. Cite the original authors using the linked paper or BibTeX.