# An MLLM-Assisted Web Crawler Approach for Web Application Fuzzing
## 5 Evaluation
### Ablation Studies  
The dialogue between CrawlMLM and MLLMs implements three strategic approaches to address key challenges in the web crawler phase of fuzzing: state extraction, functionality analysis, and automated operation generation. To quantitatively assess each strategy's contribution to web application fuzzing effectiveness, we performed comprehensive ablation studies. To determine the URL crawling sequence, we developed a state machine based on MLLM's analysis of inter-page relationships. We conducted a comparative evaluation between CrawlMLM and its variant without page state mining capabilities (CrawlMLM-NS) across nine previously mentioned Web applications over a 4-h period. Figure 7 illustrates the temporal progression of code coverage, with time plotted on the x-axis and coverage percentage on the y-axis. The experimental results demonstrate that CrawlMLM's page state mining strategy significantly enhanced code coverage across six applications, attributable to their complex business logic and tightly coupled page interactions. By leveraging page state information to determine crawler navigation sequences, the system successfully accessed deeper functional layers. However, this strategy showed no measurable improvement in code coverage for three web applications, primarily due to their simplistic nature and minimal inter-page dependencies, where crawler navigation sequencing had a negligible impact on the outcome. These findings indicate that our approach effectively addresses a fundamental limitation of traditional crawlers: their excessive reliance on links and textual content while overlooking functional dependencies. Furthermore, compared to random crawling approaches, our method generates fewer redundant requests, thereby enhancing the overall efficiency of Web application fuzzing. For the analysis of page functionality, we selected a test set of 100 pages from the Web applications enumerated in Table 1, comprising 50 simple pages and 50 complex pages (categorized based on functional complexity). We established ground truth through the manual analysis of the functional tasks within these pages and compared it against MLLM-generated results. As illustrated in Figure 8, CrawlMLM achieved complete functional analysis and task identification for all 50 simple pages. For the complex pages, MLLM successfully provided comprehensive descriptions of executable tasks for 42 pages through iterative dialogue integration. The remaining eight pages proved challenging for complete \begin{table}
\begin{tabular}{l c c c} \hline \hline
**Application** & **Burg** & **Rnd BFS\&URL** & **CrawlMLM** \\  & & **Path+Burg** & **+Burg** \\ \hline OpenEMR & 0(0) & 3(0) & 13(10) \\ Wordpress & 0(0) & 0(0) & 0(0) \\ Login Mgmt. & 1(0) & 1(0) & 1(0) \\ phpBB & 0(0) & 0(0) & 0(0) \\ osCommerce & 0(0) & 0(0) & 4(4) \\ Doctor Appt. Sys. & 2(0) & 2(0) & 2(0) \\ \hline  & 3(0) & 6(0) & 20(14) \\ \hline \hline \end{tabular}
\end{table} 
Table 3: Comparative Analysis of Vulnerability Detection Results in Production Web Applications. We analyzed the vulnerability detection performance of three scanning configurations across six production web applications, with parenthetical values representing the number of vulnerabilities uniquely identified by each configuration. analysis due to multiple factors, including structural complexity, content diversity, dynamic modifications, and state transitions triggered by user interactions, which impeded the model's ability to fully capture all relevant information. Figure 8: Evaluation of the Analytical Page Functional Modules. We selected a dataset of 100 web pages for evaluation, consisting of 50 simple pages and 50 complex pages. CrawlMLM successfully performed comprehensive functional analysis and task extraction on all 50 simple pages. For the complex pages, the system achieved successful analysis on 42 pages, while eight pages resulted in incomplete extraction. Figure 7: Code Coverage Enhancement Through Page State Mining.