一种基于 MLLM 的Web应用模糊测试方法.pdfVIP

Article

AnMLLM-AssistedWebCrawlerApproachforWeb

ApplicationFuzzing

WantongYang,EnzeWang,ZhiwenGui,YuanZhou,BaoshengWangandWeiXie*

CollegeofComputerScienceandTechnology,NationalUniversityofDefenseTechnology,

Changsha410073,China;yangwt0805@(W.Y.);wangenze18@(E.W.);

guizhiwen18@(Z.G.);yzhou@(Y.Z.);bswang@(B.W.)

*Correspondence:xiewei@

Abstract:Webapplicationfuzzingfacessignificantchallengesinachievingcomprehensive

testinterface(attacksurface)coverage,primarilyduetothecomplexityofuserinteractions

anddynamicwebsitearchitectures.Whilewebcrawlerscanautomaticallyaccessand

extractcriticalwebsiteinformation—includingformfieldsandrequestparameters—which

areessentialforgeneratingeffectivefuzzingtestcases,currentcrawlertechnologiesexhibit

threeprimarylimitations:(i)insufficientcapabilitiesinanalyzingpagerelationshipsand

determiningpagestates;(ii)lackoffunctionality-awareexplorationcapabilities,resultingin

generatedinputswithpoorcontextualrelevance;(iii)generationofunstructuredoperation

sequencesthatfailtoexecuteeffectivelyduetotheirincompatibilitywithstate-based

testinglogic.Toaddressthesechallenges,weproposeCrawlMLLM,aframeworkusing

multi-modallargelanguagemodelstosimulatehumanwebbrowsing.Itincludesthreec