# An MLLM-Assisted Web Crawler Approach for Web Application Fuzzing
## 7 Related Work  
Traditional web crawlers leverage page similarity algorithms and navigation algorithms to explore and identify webpage states. Their navigation algorithms primarily consist of random algorithms [29; 30; 31], breadth-first search (BFS) [32; 33], and depth-first search (DFS) [34; 35]. While these methods are straightforward to implement, they exhibit serious limitations when handling modern Web applications: random algorithms struggle to systematically cover application states, and BFS and DFS are susceptible to state explosion problems when dealing with large-scale applications. Regarding page similarity assessment, URL matching [1; 36] and DOM-based algorithms [37; 38; 39; 40] represent the most widely adopted methods, but these approaches excessively rely on static features and fail to accurately identify dynamically generated content and complex state transitions. Traditional crawlers primarily employ static methods for webpage content extraction, focusing solely on HTML structure and links, lacking the capability to comprehend page semantics and interaction logic, which results in insufficient coverage and missed critical functional states when handling modern Web applications. In contrast, MLLM-assisted crawlers excel at understanding page UI structure, interaction logic, and state management, enabling them to effectively process dynamic content and complex Web applications, thereby achieving comprehensive application coverage and identifying potential security vulnerabilities. Recent years have witnessed significant advancements in machine-learning approaches for application testing. In 2023, [PERSON], et al. [41] introduced a testing technique that integrates multiple machine learning methods to simulate tester verification processes by capturing interaction intentions aligned with human cognition. While this approach demonstrates exceptional performance in mobile application testing, it encounters three critical limitations: (1) the requirement for extensive labeled data to support model training, which elevates practical implementation costs; (2) the adoption of multimodal self-attention deep learning methods, involving complex model design and training processes, which compromises scalability; (3) the method's specialized design for mobile applications, with architectures and assumptions that do not address the unique characteristics of Web applications. Drawing inspiration from the research of [PERSON], et al. [41] and [PERSON], et al. [42], who introduced human interaction simulation in mobile GUI testing through functionality-aware decisions, this study employs MLLM methodology. This approach effectively reduces the computational overhead of multiple independent models through shared model weights and computing resources, while demonstrating superior performance in multi-task and multimodal data processing for simulating human interaction intentions in web applications. In the domain of fuzzing, researchers have begun exploring the potential applications of LLM. ChatAFL [43] enhances AFLNet by leveraging LLM for grammar extraction and test case generation, though its scope remains primarily confined to protocol-level testing. FuzzGPT [44] pioneered the application of LLM to fuzzing deep learning libraries through the implicit learning of API constraints for test input generation, but their methodology proves challenging to extend to complex Web application testing scenarios. Fuzz4 All [45] employs LLM as an input generation and mutation engine, introducing specialized fuzzing prompt techniques, yet fails to address the state exploration challenges in Web applications. CODAMOSA [46] utilizes Codex for generating example test cases during coverage plateaus but focuses solely on single-state test generation. While these works demonstrate LLM's potential in test generation, they do not address the challenges of intelligent navigation and state comprehension in Web application crawling.