A Cross-Language Dynamic Vulnerability Detection Methodology Driven by Multi-Model Collaboration

To address the limitations of specificity and insufficient input space coverage in existing fuzzing tools, this study proposes a cross-language dynamic vulnerability detection methodology driven by multi-model collaboration. The approach integrates GPT-4 and Grok 3 models, employing an automated prompt optimization algorithm to generate test cases that conform to both syntactic and semantic constraints of target languages, thereby enhancing test case diversity and coverage. Compared with traditional generation-based or mutation-based fuzzers, this methodology demonstrates superior flexibility and adaptability in providing effective fuzzing support for diverse programming languages and systems. To validate effectiveness, experimental evaluations were conducted on three test objects: C compiler, Java compiler, and Go toolchain. The results from 24-hour continuous testing reveal that the proposed method achieves 31.6% higher code coverage than Csmith, 13.6% higher than Hephaestus, and 20.8% higher than go-fuzz. In vulnerability detection capability verification experiments, the comprehensive detection rate reaches 90%, representing a 22-percentage-point improvement over AFL++, while maintaining a false positive rate of 4.2% - significantly lower than AFL++'s 18.7%. These quantitative outcomes substantiate the methodology's substantial advantages in enhancing test case quality and coverage, demonstrating significant implications for enhancing the security and reliability of software systems.