arXivDaily arXiv每日学术速递 周一至周五更新
arXiv 2610.17837cs.CRcs.AI

ProtoArena：AI智能体能否发现并利用真实世界中跨组件的协议漏洞？

ProtoArena: Can AI Agents Discover and Exploit Real-World Cross-Component Protocol Vulnerabilities?

Tsinghua University（清华大学）；Alibaba Group（阿里巴巴集团）；Nankai University（南开大学）；Quancheng Lab（全盛实验室）

Fasheng Miao, Zhaoyu Hu, Xiang Li, Changqing An, Jiutian Zeng, Longtao Huang, Haixin Duan, Jilong Wang

备注：
18 pages, 5 figures
阅读 PDF
arXiv 页面 ↗HTML 原文 ↗

AI总结：

本研究推出跨组件协议漏洞利用基准ProtoArena，评估5种LLM智能体，发现Claude Opus 4.8在部分场景成功率较高，但黑盒信息下整体成功率低，实验均使用授权目标。

摘要：

大型语言模型（LLM）智能体越来越多地被用于漏洞分析，但现有基准对依赖网络协议组件间交互的利用场景覆盖有限。此类漏洞源于不同参与者在消息解释、时序、状态或信任假设上的不一致。我们推出ProtoArena，这是一个黑盒、多组件、动态基准，包含80个跨组件漏洞利用环境，覆盖11个协议与应用领域及7类攻击。任务主要基于已发表的协议攻击机制设计，智能体通过受限接口与运行中的系统交互，在不获取目标源代码的情况下达成安全效果目标。三个信息层级分别评估引导式复现、结合机制与拓扑上下文的利用，以及效果导向的黑盒探索。混合验证器结合基于规则的检查与LLM对独立收集的流量和日志的审查。我们评估了5种LLM，Claude Opus 4.8取得最高观测成功率：在L1引导下为48.8%，在效果导向的黑盒L3下为12.5%。在单独的DNSBomb优化实验中，其峰值下游响应与平均查询输入字节速率比超过171000倍。结果表明，智能体可在部分跨组件环境中实现可验证的利用效果，但在有限黑盒信息下的成功率仍较低，且因领域和攻击类别而异。所有实验均使用受控、明确授权的目标，未测试生产系统或披露此前未知的漏洞。

英文摘要：

Large language model (LLM) agents are increasingly used for vulnerability analysis, yet existing benchmarks provide limited coverage of exploitation that depends on interactions among network protocol components. Such vulnerabilities arise from inconsistencies in message interpretation, timing, state, or trust assumptions across participants. We introduce ProtoArena, a black-box, multi-component, dynamic benchmark with 80 cross-component vulnerability-exploitation environments spanning 11 protocol and application domains and 7 attack categories. Tasks are primarily informed by published protocol-attack mechanisms. Agents interact with running systems through scoped interfaces to achieve security-effect objectives without target source code. Three information levels assess guided reproduction, exploitation with mechanism and topology context, and effect-directed black-box exploration. A hybrid verifier combines rule-based checks with LLM review of independently collected traffic and logs. We evaluate five LLMs. Claude Opus 4.8 achieves the highest observed success rates: 48.8% under L1 guidance and 12.5% under effect-directed black-box L3. In a separate DNSBomb optimization experiment, it achieves a peak downstream-response to average query-input byte-rate ratio exceeding 171,000 times. The results show that agents can achieve verifiable exploitation effects in some cross-component environments, but success with limited black-box information remains low and varies across domains and attack categories. All experiments use controlled, explicitly authorized targets; they do not test production systems or disclose previously unknown vulnerabilities.

机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。

↑