一句话：提出规范驱动、字段感知的 MQTT broker 模糊测试方法，以生成满足协议约束且优先高风险字段的测试用例。
MQTT 协议因其轻量性成为 IoT 通信的常见选择，而负责消息路由的 MQTT broker 存在内存破坏漏洞，带来严重安全风险。已有模糊测试工具虽能发现 broker 中的内存破坏问题，却受限于两个根本缺陷：其一，难以满足 MQTT 协议的复杂约束，导致难以生成有效测试用例；其二，不同报文之间字段变体繁多，现有黑盒 fuzzer 无法对高风险字段进行优先级排序，只能盲目变异，降低漏洞发现效率。针对上述问题，本文提出 MQueez——一种规范驱动的 MQTT broker 模糊测试方法，借助协议规范来指导有效报文的生成，并对字段变异进行风险感知的优先级划分。该文为注册报告，摘要未给出具体评估设置与实验结果。
Recently, the MQTT protocol, favored for its lightweight nature, has emerged as a preferred choice for IoT communications. However, MQTT brokers—the critical components responsible for message routing— are vulnerable to memory corruption, posing significant security risks. Although several fuzzers have been proposed to uncover memory corruption in brokers, their effectiveness is constrained by two fundamental limitations. First, existing fuzzers struggle to satisfy MQTT's complex constraints when generating valid test cases. Second, the protocol's extensive field variations across different packets complicate the mutation process, as existing black-box fuzzers cannot prioritize high-risk fields, leading to blind mutations.
DOI 原文 ·
@inproceedings{paperbot9600,
title = {MQueez: Specification-Driven Fuzzing for MQTT Broker (Registered Report)},
author = {Xinpeng Liu and Qinying Wang and Peiyu Liu and Wenhai Wang and Shouling Ji},
booktitle = {ISSTA},
year = {2025},
doi = {10.1145/3713081.3731724}
}