# Unleashing the Power of LLM to Infer State Machine From the Protocol Implementation > ProtocolGPT infers protocol state machines from implementation source code with a retrieval-augmented LLM. It extracts state-machine-related code with regular expressions and a code filter, splits it into syntax-aware chunks stored in a FAISS vector store with OpenAI embeddings, and prompts GPT-4 step by step to recover states and message-triggered transitions. On six protocols in five open-source code bases (IKEv2, TLS 1.3, TLS 1.2, BGP, RTSP and L2TP), the authors report transition precision above 90%, more than 30% higher precision and 55% higher recall than baselines. Seeding AFLNet with the inferred machines raised coverage by more than 20% and found two previously unknown crash bugs in an RTSP server. - Authors: Haiyang Wei; Ligeng Chen; Zhengjie Du; Yuhan Wu; Haohui Huang; Yue Liu; Guang Cheng; Fengyuan Xu; Linzhang Wang; Bing Mao - Venue: IWQoS 2025 - Status: Conference paper - Publication / posting date: 2025 (exact date not verified) - Date source: The publisher's Crossref deposit establishes publication year 2025. Its print date of 2 July 2025 is also the first day of the July 2–4 symposium recorded in the same deposit, and IEEE Xplore could not be retrieved automatically to confirm a publication day, so no finer date is asserted. - First arXiv submission: May 1, 2024 - arXiv: 2405.00393 - Reviewed arXiv version: v4 - DOI: 10.1109/IWQoS65803.2025.11143461 - Sources reviewed: 2026-10-27 - Added to the catalog: 2026-11-03 - Original paper: - PDF: - BibTeX: - Catalog page: - Record JSON: - Chinese version: [简体中文](https://awesomerea.org/zh/papers/paper-protocolgpt/index.md) ## Scope and limitations Requires source code; it does not work from binaries or traffic alone. Each implementation was chosen for explicitly defined states, and results cover only the six evaluated protocols, two of which share the s2n-tls code base. Ground truth was built manually by three experts from repository code; precision and recall count only fully correct transitions. RFCNLP had higher precision on RTSP. Results depend on GPT-4 at temperature 0.2 through a commercial API, so outputs and costs may change. The inferred machines are LLM summaries, not proofs of implementation behavior or equivalence. Fuzzing gains come from AFLNet seeds; BGP's event-driven transitions limited message-based coverage. The two crash bugs are in the feng RTSP server. ## Why it fits this collection Adds LLM-based protocol state-machine recovery from implementation source code, complementing the collection's traffic-based, binary-assisted and grey-box state inference research. ## Publication and review notes Crossref establishes the ten-author order, the IWQoS 2025 proceedings, pages 1–10 and the DOI; the IEEE title capitalizes “From”, while arXiv uses “from”. arXiv v4 of 2025-03-27 (v1 2024-05-01) has no journal reference or venue comment. Its benchmark pins strongSwan f994e0a, s2n-tls 025f3b2, openbgpd 08b59c1, feng d302a1c and openl2tp be6c288; the experiments ran GPT-4 on a 32 GB i7-12700 Ubuntu 20.04 machine. That version says source code and experimental data would be released after acceptance; neither arXiv nor the paper links a release. A GitHub repository, s1awwhy/ProtocolGPT, uses the paper title and contains Python scripts, but has no license and is not linked by the paper. The developer is reported to have confirmed the two RTSP bugs; no CVE identifiers are given. ## Primary sources 1. 2. 3. 4. 5. ## About this entry Reviewed against the paper and its primary sources. Cite the original authors using the linked paper or BibTeX. Original editorial content: MIT. Linked projects, papers and assets retain their own rights and licenses.