protocol parsing

Addressing the “oracle absence” and “error attribution difficulty” challenges in network protocol parser verification, this paper proposes an LLM-driven framework for RFC semantic parsing and feedback-based oracle refinement. First, large language models automatically translate unstructured RFC text into formal message specifications. Second, an iterative, quasi-oracle is constructed to support specification-guided fuzz testing and cross-language (C/Python/Go) protocol implementation verification. Finally, vulnerabilities are precisely traced back to their originating RFC clauses. This work is the first to integrate LLM-based semantic understanding with dynamic oracle refinement. Evaluated on nine mainstream protocols, it discovers 69 vulnerabilities—36 of which have been confirmed—surpassing state-of-the-art approaches in both effectiveness and efficiency. It also demonstrates, for the first time, the feasibility of fully automated derivation of test oracles directly from natural-language protocol specifications.

To address the challenge of automating testing for natural language protocol specifications—particularly in safety-critical systems—this paper proposes a two-stage methodology. First, large language models (LLMs) extract protocol elements from unstructured textual sources (e.g., RFCs). Second, an I/O grammar-based formal synthesis technique generates executable, traceable, and LLM-free formal protocol specifications. The key contribution is a curated mapping corpus bridging natural language descriptions to formal syntax, enabling version-aware specification evolution and iterative refinement. Evaluated on SMTP, POP3, IMAP, FTP, and ManageSieve, the approach achieves 92.8% average recovery of client message types and 80.2% of server message types; deployed in real systems, it attains an 81.5% message acceptance rate. This significantly enhances the accuracy, maintainability, and scalability of automated test generation for protocol implementations.

This work addresses the semantic gap between informal protocol specifications—such as IETF RFCs—and formal specifications. It introduces a cognitive discrepancy analysis framework that identifies fundamental limitations in RFCs, including semantic ambiguity, unstated assumptions, and logical inconsistency. Methodologically, the approach integrates formal specification languages (e.g., TLA⁺), state-machine modeling, and protocol conformance testing to perform semantic parsing and cross-version consistency checking on real-world RFC texts and reference implementations. A key contribution is the establishment of a collaborative paradigm bridging industry practitioners and formal methods researchers, facilitating the evolution of RFCs into verifiable, executable formal specifications. Empirical evaluation demonstrates that this methodology significantly improves defect detection rates, interoperability assurance, and depth of security verification. The proposed framework provides a reusable, scalable foundation for formalizing next-generation Internet protocol standards.

RFC documents are notoriously verbose and unstructured, impeding precise comprehension and implementation of protocol logic—particularly state machines. To address this, we propose a “summary visualization” methodology that synergistically integrates large language models (LLMs) with formal visualization techniques to parse RFC semantics, automatically extract implicit state machines, and generate traceable, interactive diagrams. Our approach supports knowledge-guided information extraction, semantic difference analysis, and user-customizable visual representations—overcoming longstanding limitations of manual diagramming or static illustrations. Evaluated on TCP and QUIC RFCs, our method systematically reconstructs previously undocumented state nodes and transitions, filling critical logical gaps absent in the original specifications. This significantly enhances specification readability, auditability, and implementation fidelity—marking the first systematic, automated recovery of latent state-machine structure from natural-language RFC text.

Current approaches to automated program synthesis lack effective governance mechanisms to ensure the compliance of generated code. This work proposes Protocol-Driven Development (PDD), a model that treats machine-executable protocols as primary artifacts and delineates the space of valid implementations through structural, behavioral, and operational invariants. PDD mandates that every implementation be accompanied by a verifiable chain of compliance evidence. By integrating formal methods, property-based testing, policy-as-code, and software provenance techniques, PDD establishes a unified framework for protocol specification and verification. This framework enables trustworthy admission control over automatically synthesized code, guaranteeing that all adopted implementations strictly adhere to protocol constraints and are backed by complete, auditable proofs of compliance.

This work addresses the loss of semantic metadata—such as node hierarchy and engineering units—when storing OPC UA time-series data in databases, as well as unstable and conflicting node identifiers across sessions from multiple OPC UA servers. To resolve these issues, the authors propose the opcua-ts architecture, which enables, for the first time, the joint persistent storage of semantic metadata alongside time-series telemetry. By leveraging lifecycle-stable connection keys, the system reconstructs the original address space and exposes it as a real-time OPC UA endpoint. Validation through NodeSet2 XML round-trip testing and experiments with a boiler simulator demonstrates that the approach accurately and robustly reconstructs multi-source OPC UA address spaces, effectively mitigating identifier conflicts and session instability.

This work addresses the lack of fine-grained evaluation benchmarks for large language models (LLMs) in generating software requirements specifications (SRS), particularly the absence of traceability among source requirements, intermediate artifacts, and generated outputs. The paper introduces the first framework to synthetically reconstruct pre-SRS artifacts with complete traceability chains from legacy SRS documents. By atomizing original SRS statements and leveraging multi-LLM voting for classification, constraint-guided prompting, and judge-guided iterative refinement, the approach produces high-fidelity intermediate artifacts. Experimental results demonstrate strong performance in both faithfulness (AlignScore 0.80–0.99) and downstream reconstructability (SBERT similarity 0.69–0.75), enabling fine-grained evaluation of SRS generation and revealing critical trade-offs among faithfulness, information retention, and artifact completeness.

This work addresses the lack of semantic guarantees in existing ladder diagram verification tools, which often leads to false negatives or false positives in safety violation detection due to imprecise translation into model checker inputs. To remedy this, the authors present the first K Framework–based, standards-faithful, and reusable executable formal semantics for IEC 61131-3 ladder diagrams. This semantics uniformly yields both an interpreter and a deductive verifier, serving as an independent audit benchmark for differential testing of translation processes. It accurately models contacts, coils, timers, counters, and retentive scan cycles, with machine-checked correctness verified via kprove. Applying this approach uncovered two real-world flaws in ESBMC: unsound certification of unsafe programs and generation of spurious counterexamples. Furthermore, it formally guarantees input/output behavioral equivalence with the standard for both combinational and latching logic.

Existing network traffic generation methods struggle to accurately model multi-flow interactions and TCP state machines because they directly decode raw packet fields, conflating behavioral semantics with protocol constraints and relying on heuristic post-hoc repairs. This work proposes TraceCodec, the first framework to integrate a neural codec with a deterministic protocol compiler in a collaborative architecture. By shifting the generation space from raw packet headers to a structured latent space of packet actions—each comprising a timestamp, an explicit flow slot, and transmission cues—and modeling sequences of continuous latent variables, TraceCodec decouples generative logic from protocol implementation. This enables synthesis of high-fidelity PCAP traces without requiring post-generation correction. Evaluated on the CICIDS2017 Monday dataset, TraceCodec achieves packet count, protocol composition, and flow size errors below 0.03%, significantly outperforming baselines in flow count accuracy, TCP state fidelity, and preservation of multi-flow interleaving structures.

Existing tools fail to correctly parse graphical PLCopen XML ladder diagrams (LDs), often producing empty intermediate representations that erroneously lead to safety verdicts. This work proposes Graph-ESBMC-PLC, the first approach to achieve complete semantic parsing and formal verification of graphical LDs. It traverses the connection graph from power rails via depth-first search to extract rung logic and translate it into Boolean expressions. Coupled with a three-layer I/O inference mechanism, it accurately generates GOTO intermediate representations for SMT-based bounded model checking, while strictly adhering to the IEC 61131-3 scan cycle semantics for SET/RESET coils. Experiments demonstrate that the method successfully produces complete IRs and verifies three graphical LD programs as SAFE (k=2, <70 ms), shows no regression on eleven textual LD benchmarks, and identifies two unsupported scenarios in Beremiz.