Self-Evolving Multi-Agent Fuzzing for Industrial IoT with Knowledge-Driven Cognitive Reasoning.

Area of Science:

• Cybersecurity
• Artificial Intelligence
• Industrial Control Systems

Background:

• Industrial Internet of Things (IIoT) security is critical but challenged by proprietary protocols vulnerable to deep-state logic flaws.
• Traditional fuzzing techniques often fail to detect these complex vulnerabilities.

Purpose of the Study:

• To introduce MALF, a Multi-Agent LLM Fuzzing Framework, for effective and efficient IIoT security testing.
• To address limitations of existing fuzzing methods in uncovering deep-state vulnerabilities in proprietary IIoT protocols.

Main Methods:

• Coupling a dynamic Industrial Security Knowledge Graph (ISKG) with collaborative cognitive agents.
• Utilizing a self-evolving knowledge loop to mitigate LLM hallucinations and ground generation in verifiable constraints.
• Employing QLoRA-tuned models for low-latency mutation and Chain-of-Thought reasoning for intent-driven attacks.

Main Results:

• MALF achieved an 88.3% average Test Case Acceptance Rate and 91.2% ISKG-defined state coverage on a heterogeneous testbed.
• It outperformed rule-based, RL-based, and LLM baselines in detecting vulnerabilities.
• MALF detected all 15 known N-Day vulnerabilities and identified 14 new candidates, with four receiving CNVD identifiers.

Conclusions:

• Knowledge-grounded AI agents, as demonstrated by MALF, can systematically expose deep-state vulnerabilities in opaque IIoT environments.
• MALF offers a trustworthy and efficient approach to IIoT security testing, surpassing existing methods.
• The framework's ability to mitigate LLM hallucinations and perform intent-driven attacks marks a significant advancement in IIoT security.