{
  "added_at": "2026-11-03",
  "arxiv_id": "2405.00393",
  "arxiv_version_reviewed": "v4",
  "authors": [
    "Haiyang Wei",
    "Ligeng Chen",
    "Zhengjie Du",
    "Yuhan Wu",
    "Haohui Huang",
    "Yue Liu",
    "Guang Cheng",
    "Fengyuan Xu",
    "Linzhang Wang",
    "Bing Mao"
  ],
  "bibtex_url": "https://awesomerea.org/papers/citations/paper-protocolgpt.bib",
  "citation": {
    "container_title": "2025 IEEE/ACM 33rd International Symposium on Quality of Service (IWQoS)",
    "pages": "1-10",
    "publisher": "IEEE",
    "sources": [
      "https://api.crossref.org/works/10.1109/IWQoS65803.2025.11143461"
    ]
  },
  "code_url": null,
  "date_basis": "The publisher's Crossref deposit establishes publication year 2025. Its print date of 2 July 2025 is also the first day of the July 2–4 symposium recorded in the same deposit, and IEEE Xplore could not be retrieved automatically to confirm a publication day, so no finer date is asserted.",
  "date_basis_zh": "出版方提交的 Crossref 元数据确认出版年份为 2025 年。其印刷日期 2025 年 7 月 2 日同时也是该元数据所记 7 月 2 日至 4 日研讨会的首日，且无法自动访问 IEEE Xplore 以确认具体出版日，因此不记录更精确的日期。",
  "date_precision": "year",
  "description_en": "ProtocolGPT infers protocol state machines from implementation source code with a retrieval-augmented LLM. It extracts state-machine-related code with regular expressions and a code filter, splits it into syntax-aware chunks stored in a FAISS vector store with OpenAI embeddings, and prompts GPT-4 step by step to recover states and message-triggered transitions. On six protocols in five open-source code bases (IKEv2, TLS 1.3, TLS 1.2, BGP, RTSP and L2TP), the authors report transition precision above 90%, more than 30% higher precision and 55% higher recall than baselines. Seeding AFLNet with the inferred machines raised coverage by more than 20% and found two previously unknown crash bugs in an RTSP server.",
  "description_zh": "ProtocolGPT 借助检索增强的大语言模型，从协议实现源码推断协议状态机。它先用正则表达式和代码过滤器提取与状态机相关的代码，再按语法感知方式切分，以 OpenAI 嵌入存入 FAISS 向量库，并逐步提示 GPT-4 恢复状态及由报文触发的迁移。在五个开源代码库中的六种协议（IKEv2、TLS 1.3、TLS 1.2、BGP、RTSP 与 L2TP）上，作者报告迁移精确率超过 90%，精确率比基线高 30% 以上、召回率高 55% 以上。以推断出的状态机为 AFLNet 生成种子后，覆盖率提升 20% 以上，并在一个 RTSP 服务器中发现两个此前未知的崩溃漏洞。",
  "doi": "10.1109/IWQoS65803.2025.11143461",
  "entry_url": "https://awesomerea.org/papers/paper-protocolgpt/",
  "entry_url_zh": "https://awesomerea.org/zh/papers/paper-protocolgpt/",
  "evidence_urls": [
    "https://doi.org/10.1109/IWQoS65803.2025.11143461",
    "https://api.crossref.org/works/10.1109/IWQoS65803.2025.11143461",
    "https://arxiv.org/abs/2405.00393",
    "https://arxiv.org/pdf/2405.00393v4",
    "https://github.com/s1awwhy/ProtocolGPT/tree/df3fceb0534e9f154d60960b879189ad40d43281"
  ],
  "first_arxiv_date": "2024-05-01",
  "id": "paper-protocolgpt",
  "json_url": "https://awesomerea.org/papers/paper-protocolgpt/record.json",
  "kind": "research",
  "markdown_url": "https://awesomerea.org/papers/paper-protocolgpt/index.md",
  "markdown_url_zh": "https://awesomerea.org/zh/papers/paper-protocolgpt/index.md",
  "metadata_notes": "Crossref establishes the ten-author order, the IWQoS 2025 proceedings, pages 1–10 and the DOI; the IEEE title capitalizes “From”, while arXiv uses “from”. arXiv v4 of 2025-03-27 (v1 2024-05-01) has no journal reference or venue comment. Its benchmark pins strongSwan f994e0a, s2n-tls 025f3b2, openbgpd 08b59c1, feng d302a1c and openl2tp be6c288; the experiments ran GPT-4 on a 32 GB i7-12700 Ubuntu 20.04 machine. That version says source code and experimental data would be released after acceptance; neither arXiv nor the paper links a release. A GitHub repository, s1awwhy/ProtocolGPT, uses the paper title and contains Python scripts, but has no license and is not linked by the paper. The developer is reported to have confirmed the two RTSP bugs; no CVE identifiers are given.",
  "metadata_notes_zh": "Crossref 确认十位作者顺序、IWQoS 2025 会议论文集、第 1–10 页及 DOI；IEEE 标题中“From”首字母大写，arXiv 则为“from”。2025-03-27 的 arXiv v4（v1 为 2024-05-01）没有期刊引用或会议备注。其基准固定了 strongSwan f994e0a、s2n-tls 025f3b2、openbgpd 08b59c1、feng d302a1c 与 openl2tp be6c288；实验在 32 GB 内存、i7-12700、Ubuntu 20.04 机器上调用 GPT-4。该版本称源码与实验数据将在论文录用后发布，但 arXiv 与论文均未链接任何发布。GitHub 仓库 s1awwhy/ProtocolGPT 使用论文标题并含 Python 脚本，但没有许可证，论文未链接。论文称开发者已确认两个 RTSP 漏洞，但未给出 CVE 编号。",
  "pdf_url": "https://arxiv.org/pdf/2405.00393v4",
  "project_url": null,
  "publication_date": null,
  "publication_status": "conference-paper",
  "record_type": "paper",
  "runtime_tested": false,
  "scope_limitations_en": "Requires source code; it does not work from binaries or traffic alone. Each implementation was chosen for explicitly defined states, and results cover only the six evaluated protocols, two of which share the s2n-tls code base. Ground truth was built manually by three experts from repository code; precision and recall count only fully correct transitions. RFCNLP had higher precision on RTSP. Results depend on GPT-4 at temperature 0.2 through a commercial API, so outputs and costs may change. The inferred machines are LLM summaries, not proofs of implementation behavior or equivalence. Fuzzing gains come from AFLNet seeds; BGP's event-driven transitions limited message-based coverage. The two crash bugs are in the feng RTSP server.",
  "scope_limitations_zh": "方法需要源码，不能仅依靠二进制或流量。每个实现都因具有明确定义的状态而入选，结果仅覆盖所评估的六种协议，其中两种共用 s2n-tls 代码库。真实标签由三名专家根据仓库代码人工构建；精确率与召回率只计算完全正确的迁移。RFCNLP 在 RTSP 上的精确率更高。结果依赖通过商业 API 调用、温度为 0.2 的 GPT-4，输出与成本可能变化。推断出的状态机是大语言模型的归纳，并非对实现行为或等价性的证明。模糊测试的提升来自 AFLNet 种子；BGP 由事件驱动的迁移限制了基于报文的覆盖率。两个崩溃漏洞均位于 feng RTSP 服务器中。",
  "targets": [
    "protocol"
  ],
  "title": "Unleashing the Power of LLM to Infer State Machine From the Protocol Implementation",
  "title_zh": "释放大语言模型潜力：从协议实现推断状态机",
  "url": "https://doi.org/10.1109/IWQoS65803.2025.11143461",
  "venue": "IWQoS 2025",
  "verification": "source-reviewed",
  "verified_at": "2026-10-27",
  "why_fits_en": "Adds LLM-based protocol state-machine recovery from implementation source code, complementing the collection's traffic-based, binary-assisted and grey-box state inference research.",
  "why_fits_zh": "补充借助大语言模型从协议实现源码恢复状态机的研究，与本合集中基于流量、借助二进制及灰盒的状态推断研究互补。",
  "year": 2025
}