2025 · Conference paper
Unleashing the Power of LLM to Infer State Machine From the Protocol Implementation
ProtocolGPT infers protocol state machines from implementation source code with a retrieval-augmented LLM. It extracts state-machine-related code with regular expressions and a code filter, splits it into syntax-aware chunks stored in a FAISS vector store with OpenAI embeddings, and prompts GPT-4 step by step to recover states and message-triggered transitions. On six protocols in five open-source code bases (IKEv2, TLS 1.3, TLS 1.2, BGP, RTSP and L2TP), the authors report transition precision above 90%, more than 30% higher precision and 55% higher recall than baselines. Seeding AFLNet with the inferred machines raised coverage by more than 20% and found two previously unknown crash bugs in an RTSP server.
Scope and limitations
Requires source code; it does not work from binaries or traffic alone. Each implementation was chosen for explicitly defined states, and results cover only the six evaluated protocols, two of which share the s2n-tls code base. Ground truth was built manually by three experts from repository code; precision and recall count only fully correct transitions. RFCNLP had higher precision on RTSP. Results depend on GPT-4 at temperature 0.2 through a commercial API, so outputs and costs may change. The inferred machines are LLM summaries, not proofs of implementation behavior or equivalence. Fuzzing gains come from AFLNet seeds; BGP's event-driven transitions limited message-based coverage. The two crash bugs are in the feng RTSP server.
Why it fits this collection
Adds LLM-based protocol state-machine recovery from implementation source code, complementing the collection's traffic-based, binary-assisted and grey-box state inference research.
Publication and review details
- Venue
- IWQoS 2025
- Status
- Conference paper
- Publication / posting date
- 2025 (exact date not verified)
- Date source
- The publisher's Crossref deposit establishes publication year 2025. Its print date of 2 July 2025 is also the first day of the July 2–4 symposium recorded in the same deposit, and IEEE Xplore could not be retrieved automatically to confirm a publication day, so no finer date is asserted.
- First arXiv submission
- May 1, 2024
- arXiv
- 2405.00393
- Reviewed arXiv version
- v4
- DOI
- 10.1109/IWQoS65803.2025.11143461
Crossref establishes the ten-author order, the IWQoS 2025 proceedings, pages 1–10 and the DOI; the IEEE title capitalizes “From”, while arXiv uses “from”. IEEE Xplore refused automated retrieval, so the published PDF was not compared with arXiv. Reviewed arXiv v4 of 2025-03-27 (v1 2024-05-01) has no journal reference or venue comment. Its benchmark pins strongSwan f994e0a, s2n-tls 025f3b2, openbgpd 08b59c1, feng d302a1c and openl2tp be6c288; the experiments ran GPT-4 on a 32 GB i7-12700 Ubuntu 20.04 machine. That version says source code and experimental data would be released after acceptance; neither arXiv nor the paper links a release. A GitHub repository, s1awwhy/ProtocolGPT, uses the paper title and contains Python scripts, but has no license, is not linked by the paper and has no established connection to the authors, so it is not listed as code. The developer is reported to have confirmed the two RTSP bugs; no CVE identifiers are given. Sources were read only; no code, model or fuzzing campaign was run.
Sources reviewed
Source review only; experiments were not rerun for this collection. Cite the original authors using the linked paper or BibTeX.