一句话：针对 MQTT 现有黑盒模糊测试难以发现漏洞的问题，研究程序感知的模糊测试策略。
MQTT 应用因协议实现薄弱而广泛面临漏洞。初步背景研究表明，MQTT 最易受畸形数据包攻击，而现有 MQTT 测试框架多基于黑盒模糊测试，导致漏洞难以且耗时地被发现。该研究旨在研究并开发面向 MQTT 协议的有效模糊测试策略，通过程序感知的方式提升测试的导向性与漏洞发现能力，从而促进 IoT 与智慧城市中更健壮的 MQTT 应用开发。目前摘要报告的是初步背景研究与研究计划，尚未给出新方法的完整实验结果。
Over the last few years, MQTT applications have been widely exposed to vulnerabilities because of their weak protocol implementations. For our preliminary research, we conducted background studies to: (1) determine the main cause of vulnerabilities in MQTT applications; and (2) analyze existing MQTT-based testing frameworks. Our preliminary results confirm that MQTT is most susceptible to malformed packets, and its existing testing frameworks are based on blackbox fuzzing, meaning vulnerabilities are difficult and time-consuming to find. Thus, the aim of my research is to study and develop effective fuzzing strategies for the MQTT protocol, thereby contributing to the development of more robust MQTT applications in IoT and Smart Cities.
DOI 原文 ·
@inproceedings{paperbot6057,
title = {Program-aware fuzzing for MQTT applications},
author = {Luis Gustavo Araujo Rodriguez and Daniel Macêdo Batista},
booktitle = {ISSTA},
year = {2020},
doi = {10.1145/3395363.3402645}
}