LLM-Based IoT Fuzzing with Format Consistency and Vulnerability-Aware Test Case Generation

The expansion of Internet of Things (IoT) devices has been accompanied by escalating malicious activities targeting their vulnerabilities. Fuzzing is an effective technique for discovering unknown vulnerabilities, with methods such as AFL and Snipuzz widely adopted. However, existing approaches often fail to apply to certain IoT devices, particularly those that conceal detailed error messages for security reasons or have closedsource implementations. This paper proposes an LLM-based IoT fuzzing test case generation method that remains effective under such constraints. By leveraging IoT communication logs and the reasoning capabilities of large language models (LLMs), our method preserves input format consistency while also inferring conditions that may trigger specific vulnerabilities. It then generates test cases tailored to efficiently induce such vulnerabilities. Evaluation results demonstrate that our method successfully detected vulnerabilities that both existing and baseline fuzzing techniques failed to uncover.