Industry Practice of LLM-Assisted Protocol Fuzzing for Commercial Communication Modules
Abstract
Fuzzing is widely used for software robustness testing. However, its application in commercial communication modules remains limited due to several key challenges, including labor-intensive template generation, lack of coverage collection support, limited testing performance, and inconsistencies between practical hardware and software CI/CD processes. In collaboration with China Mobile IoT, we present FuzzCM, a comprehensive protocol fuzzing framework tailored for commercial communication modules. FuzzCM employs a Retrieval-Augmented Generation (RAG)-enhanced large language model (LLM) to automate template generation and utilizes GPIO-based instrumentation for efficient runtime coverage data collection. Additionally, it leverages a knowledge base constructed from prior tests to guide hybrid mutation strategies and integrates CI/CD across both software and hardware layers, enabling continuous and environment-aware testing. We conducted an industrial practice with FuzzCM on five LTE Cat.1 bis modules, identifying 21 previously unknown bugs, 15 of which have been fixed. The results demonstrate that FuzzCM outperforms both manual methods and the Peach* approach, achieving average coverage improvements of 51% and 29%, respectively, with overall coverage reaching 85%.
BibTeX
@inproceedings{Fu-al:ASE25,
author = {Qiang Fu and
Changjian Liu and
Yuan Ding and
Chao Fan and
Yulai Fu and
Yuhan Chen and
Ying Fu and
Ronghua Shi and
Fuchen Ma and
Heyuan Shi},
title = {Industry Practice of {LLM-Assisted} Protocol Fuzzing for Commercial Communication Modules},
booktitle = {ASE},
pages = {3157--3167},
publisher = {{IEEE}},
year = {2025},
}