Industrial Control Protocols (ICPs) are critical to the reliability and stability of industrial infrastructure, yet their security is fundamentally compromised by a specification-blindness bottleneck. Modern fuzzers, constrained by observation-driven inference, struggle to penetrate deep protocol states or detect subtle semantic deviations. In this paper, we present AFL-ICP, an autonomous fuzzing framework that pioneers a specification-driven paradigm. AFL-ICP features a context-aware specification formalization pipeline to transform complex specifications into rigorous machine-executable grammars. Building on this formalized specification, AFL-ICP leverages LLMs to enable automated protocol adaptation and seed generation, allowing for rapid extension to new protocols with minimal manual effort. Additionally, it includes an LLM-powered differential checker that cross-references implementation outputs with specification requirements to detect subtle semantic and logic bugs that existing fuzzers cannot detect. We implement AFL-ICP and evaluate it on four widely used ICPs, including both open-source and closed-source variants. Results show that AFL-ICP significantly outperforms state-of-the-art fuzzers in coverage and uncovers 24 previously unknown vulnerabilities, for which we have received acknowledgments from affected vendors (e.g., FreyrSCADA). Specifically, the identified vulnerabilities include 16 semantic and logic bugs that can silently disrupt industrial operations and degrade service availability.

翻译：工业控制协议（ICP）对工业基础设施的可靠性与稳定性至关重要，但其安全性因协议规范盲区的瓶颈而根本性地受到损害。受限于基于观测推断的现代模糊测试工具，难以深入协议深层状态或检测细微语义偏差。本文提出AFL-ICP，一种开创规范驱动范式的自主化模糊测试框架。AFL-ICP具备上下文感知的规范形式化流水线，可将复杂协议规范转化为机器可执行的严格语法。基于形式化规范，AFL-ICP利用LLM实现协议自适应与种子生成自动化，从而以最小人工工作快速扩展至新协议。此外，该框架包含基于LLM的差异检测器，通过交叉比对实现输出与规范要求，以检测现有模糊测试工具无法发现的细微语义与逻辑缺陷。我们实现了AFL-ICP，并在四个广泛使用的ICP（包括开源与闭源变体）上进行了评估。结果表明，AFL-ICP在覆盖率上显著优于现有最先进的模糊测试工具，并发现了24个此前未知的漏洞，已获得受影响供应商（例如FreyrSCADA）的确认。具体而言，所发现的漏洞包括16个可静默破坏工业运行并降低服务可用性的语义与逻辑缺陷。