# RFCAudit: An LLM Agent for Functional Bug Detection in Network Protocols

arXiv: https://arxiv.org/abs/2506.00714 · HTML: https://mlsanity.com/paper/2506.00714/

## Key facts

- Cited by 7 papers in the map (data through 14 Oct 2026).
- Placed in Agent threats, guardrails and governance, one of 16 directions in LLM agents and tool use.
- Builds on 13 of its 57 references that are in the map.
- First posted on arXiv 31 May 2025.

## Placed in

- LLM agents and tool use / [Agent threats, guardrails and governance](https://mlsanity.com/agents/agent-threats-guardrails-and-governance/)

## Builds on (most cited first, 13 of 13)

- [AutoGen: Enabling Next-Gen LLM Applications via Multi-Agent Conversation](https://mlsanity.com/paper/2308.08155/) (2023)
- [IRIS: LLM-Assisted Static Analysis for Detecting Security Vulnerabilities](https://mlsanity.com/paper/2405.17238/) (2024)
- [CriticBench: Benchmarking LLMs for Critique-Correct Reasoning](https://mlsanity.com/paper/2402.14809/) (2024)
- [LocAgent: Graph-Guided LLM Agents for Code Localization](https://mlsanity.com/paper/2503.09089/) (2025)
- [RepoAudit: An Autonomous LLM-Agent for Repository-Level Code Auditing](https://mlsanity.com/paper/2501.18160/) (2025)
- [KNighter: Transforming Static Analysis with LLM-Synthesized Checkers](https://mlsanity.com/paper/2503.09002/) (2025)
- [LLMDFA: Analyzing Dataflow in Code with Large Language Models](https://mlsanity.com/paper/2402.10754/) (2024)
- [Validating Network Protocol Parsers with Traceable RFC Document Interpretation](https://mlsanity.com/paper/2504.18050/) (2025)
- [Linear-time Temporal Logic guided Greybox Fuzzing](https://mlsanity.com/paper/2109.02312/) (2021)
- [Large Language Models for Validating Network Protocol Parsers](https://mlsanity.com/paper/2504.13515/) (2025)
- [Lifting Network Protocol Implementation to Precise Format Specification with Security Applications](https://mlsanity.com/paper/2305.11781/) (2023)
- [ROCAS: Root Cause Analysis of Autonomous Driving Accidents via Cyber-Physical Co-mutation](https://mlsanity.com/paper/2409.07774/) (2024)
- [The Meaning of Memory Safety](https://mlsanity.com/paper/1705.07354/) (2017)

## Built on by (most cited first, 7 of 7)

- [CoRe: Benchmarking LLMs Code Reasoning Capabilities through Static Analysis Tasks](https://mlsanity.com/paper/2507.05269/) (2025)
- [TAI3: Testing Agent Integrity in Interpreting User Intent](https://mlsanity.com/paper/2506.07524/) (2025)
- [Synthesizing Precise Protocol Specs from Natural Language for Effective Test Generation](https://mlsanity.com/paper/2511.17977/) (2025)
- [CORVUS: Context Optimization and Reduction Via Underlying Synchronization for LLM Coding Agents](https://mlsanity.com/paper/2607.22711/) (2026)
- [iPanda: An LLM-based Agent for Automated Conformance Testing of Communication Protocols](https://mlsanity.com/paper/2507.00378/) (2025)
- [RFCLLM: Evaluating LLMs' Reasoning Ability of Network Protocol State Machines](https://mlsanity.com/paper/2609.13389/) (2026)
- [QuSema: Detecting Silent Bugs in Quantum Libraries via Quantum-knowledge-enhanced Agents](https://mlsanity.com/paper/2610.10258/) (2026)

## Abstract (arXiv)

Functional correctness is critical for ensuring the reliability and security of network protocol implementations. Functional bugs, instances where implementations diverge from behaviors specified in RFC documents, can lead to severe consequences, including faulty routing, authentication bypasses, and service disruptions. Detecting these bugs requires deep semantic analysis across specification documents and source code, a task beyond the capabilities of traditional static analysis tools. This paper introduces RFCAudit, an autonomous agent that leverages large language models (LLMs) to detect functional bugs by checking conformance between network protocol implementations and their RFC specifications. Inspired by the human auditing procedure, RFCAudit comprises two key components: an indexing agent and a detection agent. The former hierarchically summarizes protocol code semantics, generating semantic indexes that enable the detection agent to narrow down the scanning scope. The latter employs demand-driven retrieval to iteratively collect additional relevant data structures and functions, eventually identifying potential inconsistencies with the RFC specifications effectively. We evaluate RFCAudit across six real-world network protocol implementations. RFCAudit identifies 47 functional bugs with 81.9% precision, of which 20 bugs have been confirmed or fixed by developers.