LLM-Guided Initial Seed Selection for Black-Box IoT Fuzzing to Enhance Vulnerability Detection

Fuzzing is a vulnerability testing approach that generates a large number of test cases based on initial values (initial seeds), sends them to the target device, and attempts to trigger unexpected behaviors. Fuzzing of IoT devices is one of the effective ways for detecting unknown vulnerabilities. From the perspective of testing efficiency, the set of initial seeds should be as small as possible while ensuring sufficient exploration of the input space. Conventional seed selection methods often rely on source code coverage, but this is difficult to apply in the context of IoT devices, where its source code is frequently unavailable. In this paper, we propose a method that leverages large language models (LLMs) to infer the internal specifications of IoT devices from communication logs and to select effective initial seeds among candidate seeds, even when the devices are black-box and neither source code nor internal states are accessible. Experimental results show that the proposed method successfully selected 15 initial seeds from 63 candidates and detected more vulnerabilities in a shorter time compared to using all seeds or random selection.