Self-Evolving Multi-Agent Fuzzing for Industrial IoT with Knowledge-Driven Cognitive Reasoning

Securing the Industrial Internet of Things (IIoT) is paramount, yet proprietary protocols remain vulnerable to deep-state logic flaws that traditional fuzzers often fail to reach. We propose MALF, a Multi-Agent LLM Fuzzing Framework that couples a dynamic Industrial Security Knowledge Graph (ISKG) with collaborative cognitive agents for effective, efficient, and trustworthy IIoT security testing. A self-evolving knowledge loop mitigates LLM hallucinations by grounding the generation in verifiable graph constraints; QLoRA-tuned models aligned with hexadecimal features enable low-latency mutation; and Chain-of-Thought reasoning reconstructs protocol states for intent-driven attacks. On a heterogeneous testbed spanning five industrial protocols and ten vendors, MALF achieves an average Test Case Acceptance Rate of 88.3% (peak 91.2% on Modbus/TCP) and 91.2% ISKG-defined state coverage, outperforming rule-based, RL-based, and LLM baselines. On a 15-vulnerability N-Day benchmark, MALF detects all known cases, against 60%, 47%, 40%, and 27% for NCMFuzzer, MARLFuzz, BooFuzz, and Fuzz4All, respectively. In a separate real-world campaign, MALF further identifies 14 previously unknown vulnerability candidates, of which four have been assigned CNVD identifiers (CNVD-2024-16009, CNVD-2025-22875, CNVD-2025-29811, CNVD-2026-06041) and 10 remain under vendor review. These results provide controlled-testbed evidence that knowledge-grounded AI agents can systematically expose deep-state vulnerabilities in opaque IIoT environments.