MQTT protocol gray box fuzzing method and system based on cross-implementation difference metric

Abstract

The application relates to the technical field of network protocol security testing, and discloses an MQTT protocol gray box fuzzy testing method and system based on cross-implementation difference measurement. The method comprises the following steps: a double-implementation execution environment oriented to the MQTT protocol is constructed; standardized processing is performed on execution behavior data of test input, and a difference feature set is extracted; a semantic-priority weighted scoring mode is used for quantitative evaluation, and a difference score result is obtained; a difference feedback encoding mechanism is used to generate a difference feedback signal, and the difference feedback signal is mapped into a control flow change; the difference feedback signal and a coverage feedback signal identified according to the control flow change are jointly used in a seed evaluation process; when a new difference feedback signal is triggered by the test input, the current test input is preferentially reserved to a seed queue and is guided to input evolution search. The application can improve the discovery capability of the fuzzy testing on protocol state machine defects, inconsistent abnormal input processing and potential security vulnerabilities.

Description

Technical Field

[0001] This invention relates to the field of network protocol security testing technology, specifically to a gray-box fuzzy testing method and system for the MQTT protocol based on cross-implementation differential metrics. Background Technology

[0002] With the rapid development of IoT devices, industrial control systems, and edge computing platforms, the MQTT (Message Queuing Telemetry Transport) protocol, designed for low-bandwidth, low-power, and high-concurrency scenarios, has been widely used in fields such as smart homes, industrial internet, vehicle networking, and embedded device communication.

[0003] Due to its low communication overhead, high transmission efficiency, and flexible implementation, the MQTT protocol's protocol parsing component has gradually become a core foundational module in numerous IoT platforms and embedded systems. However, because MQTT implementations are deployed and operate in open and complex network environments, they are highly vulnerable to malicious traffic sniffing, forgery, and denial-of-service attacks. Therefore, its security and reliability have become a crucial area of ​​research in protocol security and vulnerability discovery.

[0004] The communication specifications of the MQTT protocol are primarily defined by RFC documents and the OASIS standard. These standards typically specify the protocol message format, field semantics, state transition rules, and communication flow constraints, but do not strictly limit the specific underlying software implementation. Therefore, different MQTT Brokers (such as Mosquitto, EMQX, HiveMQ, Vernemq, etc.) or lightweight protocol parsing implementations often employ different processing logics in error code mapping, exception input handling, field validity validation, and state machine transition strategies, depending on their design goals, operating environment, or performance considerations. For example, significant semantic differences can arise between implementations regarding the tolerance for illegal fields, the state recovery method after connection loss, the validation of high-order fields in SUBSCRIBE messages, and the classification and handling of exception messages. While this diversity at the implementation level improves the protocol's engineering adaptability and flexibility, it also easily leads to protocol compatibility issues, state machine logic defects, and deep-seated potential security vulnerabilities (such as logical privilege escalation, memory corruption, and state deadlock).

[0005] To uncover security vulnerabilities in these protocol implementations, most existing security testing methods for the MQTT protocol implementation are based on coverage-guided fuzzing techniques such as AFL (American Fuzzy Lop). These methods primarily involve instrumenting the target program during the compilation or runtime phases to monitor changes in control flow coverage (such as basic block coverage or edge coverage) driven by test inputs in real time, and adding test samples that trigger new execution paths to a seed queue, thereby guiding the mutation and retention of test inputs. However, when faced with protocol parsing scenarios like MQTT, which are highly context-dependent and possess complex state transition characteristics, existing security testing techniques reveal significant limitations. Specifically, this manifests in several ways: Traditional coverage feedback mechanisms rely primarily on the extension of program control flow paths, resulting in a severe deficiency in their ability to perceive high-value protocol semantic layer behavioral discrepancies (such as different exception handling logic or inconsistent state transitions). This leads to the discarding of numerous critical samples that, while potentially triggering deep logical defects, do not significantly alter the control flow path during evolutionary searches. Furthermore, existing differential testing techniques typically only perform static comparisons of execution results in the later stages of testing, forming a unidirectional open-loop structure of "generation-comparison." The difference information is not dynamically introduced into the mutation feedback of fuzz testing, making the testing system prone to a "path explosion" dilemma of blind mutation due to a lack of directional guidance. In addition, directly performing differential testing on heterogeneous, real, and complete brokers introduces a large amount of non-critical system behavioral noise, such as network protocol stack, multi-threaded scheduling, and disk I / O, leading to numerous false alarms. The enormous system overhead severely limits test throughput, resulting in low efficiency in uncovering deep semantic vulnerabilities in stateful protocols.

[0006] Therefore, how to construct a lightweight protocol dual-execution environment that can effectively eliminate system-level noise, and design a technical solution that can accurately perceive multi-dimensional behavioral differences between protocol implementations and further transform the differential measurement results into closed-loop dynamic feedback signals that can be perceived by gray-box fuzzing tests, thereby improving the automated mining capabilities of fuzzing tests for protocol semantic anomalies, state machine defects, and implementation inconsistencies, has become an important technical challenge that urgently needs to be solved in the current protocol security testing and network security fields. Summary of the Invention

[0007] To address the aforementioned shortcomings in existing technologies, this invention provides a gray-box fuzzing method and system for the MQTT protocol based on cross-implementation differential metrics. This method is grounded in the minimal processing core of the MQTT protocol. By constructing a cross-implementation dual execution environment, it compares and analyzes the execution behavior of the same input sample under different protocol semantic policies. Furthermore, it transforms these behavioral differences into dynamic feedback signals perceptible to gray-box fuzzing, thereby enhancing the fuzzing's ability to detect protocol state machine defects, inconsistent handling of abnormal inputs, and potential security vulnerabilities.

[0008] To achieve the above-mentioned objectives, the technical solution adopted by this invention is as follows:

[0009] In a first aspect, this invention proposes a gray-box fuzzy testing method for the MQTT protocol based on cross-implementation differential metrics, comprising the following steps:

[0010] Construct a dual-implementation execution environment for the MQTT protocol; the dual-implementation execution environment includes a first execution instance and a second execution instance that share the same MQTT protocol processing logic, and their behavior is constructed by loading different protocol policy configuration files;

[0011] The test input is fed into the first execution instance and the second execution instance respectively. The resulting execution behavior data is standardized and a differential feature set is extracted from three dimensions: protocol semantic layer, structural behavior layer and fine-grained semantic observation layer.

[0012] The differential feature set is quantitatively evaluated using a semantic-first weighted scoring method to obtain differential scoring results;

[0013] A differential feedback coding mechanism is used to generate a differential feedback signal based on the differential scoring result, and the differential feedback signal is mapped to a control flow change that the fuzzy testing system can perceive.

[0014] The differential feedback signal and the coverage feedback signal identified based on control flow changes are used together in the seed evaluation process. When a test input triggers a new differential feedback signal, the current test input is preferentially retained in the seed queue and the input evolution search is guided.

[0015] Furthermore, constructing a dual-implementation execution environment for the MQTT protocol includes:

[0016] A lightweight protocol processing unit containing only the core protocol logic is extracted from the real MQTT broker server, and system-level components unrelated to the protocol semantics are removed, serving as the basic runtime environment for the first execution instance and the second execution instance;

[0017] Configure different protocol policy configuration files for the first execution instance and the second execution instance respectively; the protocol policy configuration files describe the semantic difference behavior in the protocol processing process, including at least one of the following: exception message error code mapping policy, reconnection policy after disconnection, subscription option processing policy, and field lenient validation policy.

[0018] Furthermore, the lightweight protocol processing unit retains the functions related to message parsing, field validation, protocol state transition, and control message processing in the MQTT protocol, while removing network communication, multi-threaded scheduling, and persistent storage components.

[0019] Furthermore, before inputting the test input into the first execution instance and the second execution instance respectively, the process further includes:

[0020] The protocol status, runtime cache, and statistics of the lightweight protocol processing unit are initialized.

[0021] Furthermore, the test input is a control message of the MQTT protocol, which includes at least one of connection messages, publish messages, subscribe messages, unsubscribe messages, and disconnect messages.

[0022] Furthermore, the differential feature set extracted from three dimensions—the protocol semantic layer, the structural behavior layer, and the fine-grained semantic observation layer—includes:

[0023] In the protocol semantic layer, the execution results of the first execution instance and the second execution instance are compared, and the differences in return results and state transitions are extracted;

[0024] In the structural behavior layer, the processing procedures of the first execution instance and the second execution instance are compared to extract the differences in the number of messages processed and the differences in the input consumption progress.

[0025] In the fine-grained semantic observation layer, a semantic observation mechanism is used at key nodes of the protocol to extract the execution differences of message admission judgment events, field verification events, and state transition decision events.

[0026] Furthermore, a semantic-first weighted scoring method is used to quantitatively evaluate the differential feature set, resulting in differential scoring results, including:

[0027] A first weight is assigned to the differences in return results and state transitions of the protocol semantic layer; a second weight is assigned to the differences in the number of messages processed and the input consumption progress of the structure behavior layer; and a third weight is assigned to the differences in execution of the fine-grained semantic observation layer; wherein the first weight is greater than the second weight, and the second weight is greater than the third weight.

[0028] The initial difference score is obtained by weighted summation based on the difference values ​​of each dimension and their corresponding weights.

[0029] The initial differential score is mapped to discrete differential levels using a hierarchical bucketing strategy to obtain the differential score result.

[0030] Furthermore, a differential feedback coding mechanism is employed to generate a differential feedback signal based on the differential scoring result, and the differential feedback signal is mapped to a control flow change perceptible to the fuzzy testing system, including:

[0031] The differential scoring results are filtered according to a preset differential level threshold, and low-value differences below the differential level threshold are filtered out.

[0032] The selected differential levels are combined with the corresponding differential feature information and encoded to generate a unique differential feedback identifier;

[0033] The differential feedback identifier is mapped to a new control flow path in the coverage feedback by using a control flow mapping mechanism, so that the differences in protocol behavior enter the fuzz testing framework in the form of control flow feedback.

[0034] Furthermore, the differential feedback signal and the coverage feedback signal identified based on control flow changes are jointly used in the seed evaluation process. When a test input triggers a new differential feedback signal, the current test input is preferentially retained in the seed queue and the input evolution search is guided, including:

[0035] During the seed scheduling phase, if a test input triggers a differential feedback signal that is not recorded in the differential feedback bitmap, the energy allocation and mutation priority of the seed corresponding to that test input will be increased.

[0036] During the input mutation phase, the seeds that trigger high differential level feedback are mutated first to guide the fuzz test to explore the deep state space of the protocol behavior divergence region.

[0037] Secondly, this invention proposes an MQTT protocol gray-box fuzzy testing system based on cross-implementation differential metrics, applying the aforementioned MQTT protocol gray-box fuzzy testing method based on cross-implementation differential metrics, including:

[0038] A dual-implementation execution environment construction module is used to construct a dual-implementation execution environment for the MQTT protocol. The dual-implementation execution environment includes a first execution instance and a second execution instance that share the same MQTT protocol processing logic, and their behavior is constructed by loading different protocol policy configuration files.

[0039] The differential feature extraction module is used to input the test input into the first execution instance and the second execution instance respectively, perform standardization processing on the generated execution behavior data, and extract differential feature sets from three dimensions: protocol semantic layer, structural behavior layer and fine-grained semantic observation layer.

[0040] The differential scoring module is used to quantitatively evaluate the differential feature set using a semantic-first weighted scoring method to obtain differential scoring results;

[0041] The differential feedback guidance module is used to generate a differential feedback signal based on the differential scoring result using a differential feedback coding mechanism, and to map the differential feedback signal into a control flow change that the fuzzy testing system can perceive; the differential feedback signal and the coverage feedback signal identified based on the control flow change are used together in the seed evaluation process; when the test input triggers a new differential feedback signal, the current test input is preferentially retained in the seed queue and the input evolution search is guided.

[0042] The present invention has the following beneficial effects:

[0043] This invention achieves dynamic mapping of protocol behavior differences to gray-box fuzzing feedback paths by constructing a cross-implementation dual execution environment and a differential feedback guidance mechanism. This allows fuzzing to not only focus on changes in program execution paths but also to further perceive behavioral discrepancies at the protocol semantic level, thereby improving the detection capabilities for protocol state machine anomalies, inconsistent handling of abnormal inputs, and potential security issues. Compared to traditional fuzzing methods that rely solely on coverage feedback, this invention can more effectively identify behavioral differences caused by different semantic strategies during protocol parsing. Through differential result quantification, level control, and dynamic feedback mechanisms, it reduces feedback noise caused by low-value differences, improving the stability and feedback utilization efficiency of the fuzzing search process. Furthermore, without altering the basic operating mode of existing gray-box fuzzing, this invention integrates protocol behavior differences and feedback guidance mechanisms, enhancing fuzzing's ability to retain high-value test inputs. This improves the efficiency of discovering protocol state machine defects, inconsistent handling of abnormal inputs, and potential vulnerabilities, making it more suitable for gray-box fuzzing and protocol security analysis in the MQTT protocol scenario. Experimental results show that the present invention can effectively improve the ability of test input to explore differences in protocol behavior during protocol fuzzing, and achieve good test results in terms of code coverage increase and high-value execution path discovery. Attached Figure Description

[0044] Figure 1 This is a schematic diagram of the MQTT protocol gray-box fuzzy testing method based on cross-implementation differential metric according to the present invention;

[0045] Figure 2 This is a schematic diagram of the architecture of the present invention;

[0046] Figure 3 This is a flowchart of the dual-implementation execution mechanism in this invention;

[0047] Figure 4 This is a flowchart of the execution result alignment and comparison mechanism in this invention;

[0048] Figure 5 This is a flowchart illustrating the differential metric feedback mechanism in this invention.

[0049] Figure 6 This is a grouped comparison chart of performance and multidimensional indicators under different injection ratios in this invention. Detailed Implementation

[0050] The specific embodiments of the present invention are described below to enable those skilled in the art to understand the present invention. However, it should be understood that the present invention is not limited to the scope of the specific embodiments. For those skilled in the art, various changes are obvious as long as they are within the spirit and scope of the present invention as defined and determined by the appended claims. All inventions utilizing the concept of the present invention are protected.

[0051] This invention constructs a closed-loop testing system consisting of a dual-implementation execution environment, a differential feature extraction mechanism, a differential scoring mechanism, and a differential feedback guidance mechanism. For the same test input, the system first simultaneously delivers it to the dual-implementation execution environment with differentiated semantic processing strategies, and collects execution behavior data generated during the execution on both sides. Subsequently, the execution behavior data is uniformly aligned and compared to extract a set of differential features, including differences in protocol processing results, state transitions, message processing, input consumption, and semantic observation. Further, the differential features are quantified using a semantic-first differential scoring mechanism to obtain the corresponding differential strength, and a level-based bucketing strategy is used to map continuous scores to discrete differential levels. Finally, a differential feedback encoding mechanism maps high-value differential levels to differential feedback signals perceptible to the fuzzy testing system, which then participate in subsequent seed scheduling and input mutation processes, thereby achieving continuous searching and targeted exploration of high-value protocol behavior divergences.

[0052] This invention targets network protocols with complex state transition relationships and strict semantic constraints. By introducing cross-implementation behavioral differences as a novel feedback source, the fuzzing process can perceive behavioral discrepancies between different protocol semantic processing strategies while focusing on changes in program control flow paths. This enhances the ability to explore and uncover deep state spaces, critical semantic paths, and potential security vulnerabilities of protocols.

[0053] This invention achieves the generation of controllable protocol behavior differences by constructing an A / B dual execution mechanism under a unified protocol logic; it achieves structured analysis and quantitative evaluation of protocol semantic disagreements by constructing a multi-dimensional behavior differential measurement mechanism; and it further encodes high-value behavior differences into feedback signals that can be perceived by the AFL by constructing a semantic-first differential feedback mechanism, thereby forming a dynamic closed-loop mechanism of "cross-implementation protocol execution - behavior difference extraction - differential feedback injection - input evolution search".

[0054] like Figure 1 and Figure 2As shown, an embodiment of the present invention provides a gray-box fuzzy testing method for the MQTT protocol based on cross-implementation differential metrics, comprising the following steps S1 to S5:

[0055] S1. Construct a dual-implementation execution environment for the MQTT protocol; the dual-implementation execution environment includes a first execution instance and a second execution instance that share the same MQTT protocol processing logic, and constructs behavior differences by loading different protocol policy configuration files;

[0056] In an optional embodiment of the present invention, step S1, constructing a dual-implementation execution environment for the MQTT protocol, includes:

[0057] A lightweight protocol processing unit containing only the core protocol logic is extracted from the real MQTT broker server, and system-level components unrelated to the protocol semantics are removed, serving as the basic runtime environment for the first execution instance and the second execution instance;

[0058] Configure different protocol policy configuration files for the first execution instance and the second execution instance respectively; the protocol policy configuration files describe the semantic difference behavior in the protocol processing process, including at least one of the following: exception message error code mapping policy, reconnection policy after disconnection, subscription option processing policy, and field lenient validation policy.

[0059] This embodiment addresses the characteristics of the MQTT protocol, such as multi-stage interaction, obvious state dependencies, and strict semantic constraints, by constructing a dual-implementation execution environment for differential analysis, providing a unified operational foundation for subsequent differential feature extraction and differential feedback generation.

[0060] This embodiment takes the MQTT protocol processing flow as the object, extracts the core logic related to protocol parsing and state transition, and constructs a lightweight protocol processing unit. This lightweight protocol processing unit retains key functions related to message parsing, field validation, protocol state transition, and control message processing in the MQTT protocol, including the processing of typical control messages such as connection messages, publish messages, subscribe messages, unsubscribe messages, and disconnect messages. At the same time, it removes network communication, multi-threaded scheduling, persistent storage, and other system-level components unrelated to protocol semantics, thereby reducing testing overhead and minimizing the impact of external environmental noise on the execution results.

[0061] Based on this, this embodiment constructs a dual-implementation execution environment consisting of an A-side execution instance and a B-side execution instance. Both execution instances share the same MQTT protocol processing logic but employ different protocol semantic processing strategies. Specifically, the A-side execution instance uses a strict semantic processing strategy to simulate processing behavior that strictly adheres to the protocol specification; the B-side execution instance uses a lenient semantic processing strategy to simulate protocol implementation behavior with differences in compatibility handling, fault tolerance handling, or exception handling. The two execution instances construct their behavioral differences by loading different protocol strategy configuration files, without relying on different code versions or heterogeneous implementations. This avoids additional noise introduced by differences in implementation scale, code structure, and runtime environment, ensuring that both execution environments have a unified functional foundation and a controllable source of behavioral differences.

[0062] The protocol policy configuration file describes the semantic differences that may exist during protocol processing, including error code mapping strategies for abnormal messages, reconnection strategies after disconnection, subscription option processing strategies, and field lenient validation strategies. By configuring differentiated semantic policies, the same test input can produce differences in return results, state transitions, and protocol processing behaviors when run in dual-implementation execution environments, providing observable data sources for subsequent differential feature extraction.

[0063] To ensure the accuracy of the differential analysis results, this embodiment employs a combined input multiplexing and execution isolation approach, such as... Figure 3 As shown. For any test input, the input data is first loaded into a unified buffer, and identical input content is simultaneously distributed to both execution instances on side A and side B. Subsequently, the two instances complete the protocol parsing and state processing processes in their respective independent execution contexts. Before each execution begins, the protocol state, runtime cache, and statistics are initialized to avoid interference from historical state residues on the execution results.

[0064] After execution, execution behavior data generated during the execution process on both sides are collected, including protocol processing return results, state transition results, message processing status, input consumption status, and semantic observation information at key protocol nodes, forming corresponding execution result records. Since the execution instances on both sides receive the same input and operate in independent environments, the obtained behavioral differences can accurately reflect the actual discrepancies between different protocol semantic processing strategies, providing a reliable data foundation for differential feature extraction and differential measurement in subsequent steps.

[0065] S2. Input the test input into the first execution instance and the second execution instance respectively, perform standardized processing on the generated execution behavior data, and extract differential feature sets from three dimensions: protocol semantic layer, structural behavior layer and fine-grained semantic observation layer.

[0066] In an optional embodiment of the present invention, step S2 extracts a differential feature set from three dimensions: the protocol semantic layer, the structural behavior layer, and the fine-grained semantic observation layer, including:

[0067] In the protocol semantic layer, the execution results of the first execution instance and the second execution instance are compared, and the differences in return results and state transitions are extracted;

[0068] In the structural behavior layer, the processing procedures of the first execution instance and the second execution instance are compared to extract the differences in the number of messages processed and the differences in the input consumption progress.

[0069] In the fine-grained semantic observation layer, a semantic observation mechanism is used at key nodes of the protocol to extract the execution differences of message admission judgment events, field verification events, and state transition decision events.

[0070] In this embodiment, after completing protocol processing in a dual-implementation execution environment, execution behavior data corresponding to execution instances on side A and side B are obtained respectively. Since different semantic processing strategies may lead to differences in protocol processing results, state transition paths, and message parsing processes, a differential feature extraction mechanism is needed to uniformly analyze the execution results on both sides in order to extract a set of differential features that can reflect the differences in protocol behavior, providing basic data support for subsequent differential scoring and feedback guidance.

[0071] The differential feature extraction mechanism compares and analyzes the execution results from three levels: the protocol semantic layer, the structural behavior layer, and the fine-grained semantic observation layer. Figure 4 As shown, the protocol semantic layer mainly extracts differences in return results and state transitions; the structural behavior layer mainly extracts differences in the number of messages processed and the number of bytes consumed; and the fine-grained semantic observation layer captures potential behavioral differences when the higher-level execution results are consistent by deploying semantic observation points in the key processing paths of the protocol to record key events in field parsing, QoS verification, subscription option processing, and state transition processes.

[0072] This invention first standardizes the execution behavior data generated by the dual-implementation execution environment. The protocol processing results generated during execution on both sides are uniformly mapped to a predefined data structure, and the protocol processing return results, final status information, message processing statistics, input consumption statistics, and semantic observation information are recorded in the same data organization format. This eliminates the data representation differences caused by different execution strategies and ensures a consistent data foundation for subsequent comparison processes.

[0073] After standardization, a dimension-by-dimensional alignment analysis is performed on the execution behavior data generated by the execution instances on side A and side B. For the same test input, this embodiment sets return result difference flags, status difference flags, message processing difference flags, input consumption difference flags, and semantic observation difference flags for protocol processing return results, protocol status, message processing statistics, input consumption statistics, and semantic observation information, respectively. Each difference flag is used to characterize whether there are execution differences in the corresponding behavior dimension. The generation method is as follows: compare the corresponding behavior data of the two execution instances; if the comparison results are inconsistent, the corresponding difference flag is set; otherwise, it remains unset. The protocol processing return result is used to characterize the overall processing conclusion of the protocol implementation for the current input. When the two execution instances produce different return results for the same input, it indicates that the protocol implementation has differences in its judgment of the legality or anomaly classification of the current input, and return result difference features are generated accordingly.

[0074] Protocol state information is used to describe the evolution of the protocol state machine during processing. In this embodiment, the final states of the two execution instances after completing protocol processing are recorded and compared for consistency. When the state transition results on both sides are different, it is considered that the current input has triggered a divergence in protocol state behavior, and the corresponding state difference flag is set to characterize the behavioral difference of the current test input in the protocol state transition dimension, thereby generating state difference features.

[0075] Message processing statistics are used to reflect changes in the execution path during protocol parsing. This embodiment separately calculates the message processing statistics for both execution instances during protocol processing, including the total number of messages processed and the number of successfully processed messages, and performs a consistency comparison. When the message processing statistics for both sides differ, it is considered that the current input has triggered a behavioral divergence in the protocol processing flow, and the corresponding message processing difference flag is set to characterize the behavioral difference of the current test input in the message processing dimension, thereby generating message processing difference features.

[0076] Input consumption statistics are used to describe the actual processing progress of input data during protocol processing. This embodiment records the byte consumption position during protocol parsing and performs consistency comparisons. When the input consumption positions on both sides differ, it is considered that the current input has triggered a behavioral divergence at the protocol parsing depth, and the corresponding input consumption difference flag is set to characterize the behavioral difference in the input consumption dimension of the current test input, thereby generating input consumption difference features.

[0077] In addition to the aforementioned macroscopic behavioral characteristics, to further enhance the ability to perceive changes in protocol semantic behavior, this embodiment also deploys a semantic observation mechanism at key semantic nodes in the MQTT protocol processing flow. These key semantic nodes include locations such as protocol message admission judgment, field validity verification, state transition decisions, and error handling logic. This embodiment records the triggering of relevant semantic events on both execution instances and performs consistency comparisons. When there are differences in the semantic observation information on both sides, it is considered that the current input has triggered a behavioral divergence at the protocol semantic level, and the corresponding semantic observation difference flag is set to characterize the behavioral difference of the current test input in the protocol semantic dimension, thereby generating semantic observation difference features.

[0078] After completing the above analysis, this embodiment organizes the return result differential features, state differential features, message processing differential features, input consumption differential features, and semantic observation differential features into a unified differential feature set. This differential feature set is used to describe the behavioral divergence of the same test input in a dual-implementation execution environment, realizing the transformation from raw execution behavior data to structured differential information, and providing a unified and quantifiable input basis for the differential scoring mechanism in subsequent steps.

[0079] S3. The differential feature set is quantitatively evaluated using a semantic-first weighted scoring method to obtain the differential scoring results;

[0080] In an optional embodiment of the present invention, step S3 uses a semantic-first weighted scoring method to quantify and evaluate the differential feature set to obtain a differential scoring result, including:

[0081] A first weight is assigned to the differences in return results and state transitions of the protocol semantic layer; a second weight is assigned to the differences in the number of messages processed and the input consumption progress of the structure behavior layer; and a third weight is assigned to the differences in execution of the fine-grained semantic observation layer; wherein the first weight is greater than the second weight, and the second weight is greater than the third weight.

[0082] The initial difference score is obtained by weighted summation based on the difference values ​​of each dimension and their corresponding weights.

[0083] The initial differential score is mapped to discrete differential levels using a hierarchical bucketing strategy to obtain the differential score result.

[0084] This embodiment, after extracting differential features, obtains a set of differential features to describe the behavioral differences in the dual-implementation execution environment. However, different types of differential features reflect varying degrees of protocol behavioral differences. For example, changes in protocol processing return results or state transition results can usually directly reflect semantic-level differences in the protocol, while changes in message processing quantity or input consumption progress reflect more structural differences in the protocol execution path. Treating all differential features equally not only makes it difficult to accurately reflect the importance of the differences but also easily leads to low-value differences interfering with subsequent feedback processes. Therefore, this embodiment further constructs a differential scoring mechanism to uniformly quantify and evaluate the extracted differential feature set and convert discrete differential features into measurable differential strengths.

[0085] The differential scoring mechanism employs a semantic-first weighted scoring method, assigning different weights to different types of differential features. Differences in returned results and state transitions, as core semantic differences, receive higher weights; differences in message processing and byte consumption, as structural-behavioral differences, receive secondary weights; and fine-grained semantic observation differences participate in the scoring as auxiliary differences. The differential strength corresponding to the input sample is calculated through differential scoring, and a tiered bucketing method is further used to map continuous scores to discrete differential levels, forming a unified differential metric.

[0086] This embodiment first uniformly encodes the obtained differential features of return results, state differential features, message processing differential features, input consumption differential features, and semantic observation differential features, and then constructs a differential scoring function:

[0087]

[0088] in, , , , These represent the differential features of the returned results, the differential features of the status, the differential features of the message processing, and the differential features of the input consumption, respectively. , , , The weight parameter represents the corresponding differential feature and is used to reflect the importance of the differences in behavior between different types of protocols.

[0089] To further enhance the ability to perceive changes in protocol semantic behavior, this embodiment introduces semantic observation differential features as an auxiliary scoring item into the scoring process, and its additional scoring function is defined as follows:

[0090] in, Represents semantic observation difference features, The weight parameters represent the semantic observation difference features. This indicates the upper limit of the additional score.

[0091] Through the above design, semantic observation differential features only participate in the scoring when the system has detected differences in the protocol semantic layer. This avoids fine-grained observation signals triggering high scores on their own and reduces the noise impact caused by local execution fluctuations. Simultaneously, by assigning higher weights to the return result differential features and state differential features, the scoring results focus more on behavioral discrepancies at the protocol semantic level, rather than simply changes in the execution path.

[0092] After completing the scoring calculation, this embodiment obtains the differential strength corresponding to the current test input. The differential strength is used to describe the overall degree of behavioral divergence between the two implementation execution environments. The higher the value, the more obvious the difference in protocol behavior triggered by the current input, and the higher the potential semantic value.

[0093] To further improve the stability and controllability of the subsequent feedback process, this embodiment also performs hierarchical binning on the continuous differential intensities. Specifically, the differential intensities are mapped to a finite number of discrete differential levels according to a preset scoring interval, transforming the originally continuously changing scoring results into stable level information. This method effectively reduces feedback jitter caused by minute scoring fluctuations and also reduces the fragmentation of the differential feedback space.

[0094] Finally, the differential level corresponding to the current test input is obtained, and it is used as the input basis for the differential feedback coding mechanism to realize a unified quantization mapping from the differential feature set to the differential level.

[0095] S4. A differential feedback coding mechanism is used to generate a differential feedback signal based on the differential scoring result, and the differential feedback signal is mapped to a control flow change that the fuzzy testing system can perceive.

[0096] In an optional embodiment of the present invention, step S4 employs a differential feedback coding mechanism to generate a differential feedback signal based on the differential scoring result, and maps the differential feedback signal to a control flow change perceptible to the fuzzy testing system, including:

[0097] The differential scoring results are filtered according to a preset differential level threshold, and low-value differences below the differential level threshold are filtered out.

[0098] The selected differential levels are combined with the corresponding differential feature information and encoded to generate a unique differential feedback identifier;

[0099] The differential feedback identifier is mapped to a new control flow path in the coverage feedback by using a control flow mapping mechanism, so that the differences in protocol behavior enter the fuzz testing framework in the form of control flow feedback.

[0100] This embodiment uses a differential scoring mechanism to quantitatively evaluate the differential feature set and obtain the corresponding differential levels. However, the fuzzing system itself cannot directly perceive behavioral differences at the protocol semantic level. Therefore, it is necessary to further convert the differential levels into feedback information that the fuzzing system can utilize, thereby participating in subsequent seed scheduling and input mutation processes. To this end, this invention constructs a differential feedback encoding mechanism. Through processes such as differential filtering, feedback encoding, and control flow mapping, it transforms protocol behavioral differences into feedback signals that the gray-box fuzzing system can perceive, realizing the dynamic guidance of protocol semantic information on the testing process.

[0101] The differential feedback coding mechanism filters the differential results based on preset thresholds, differential levels, and probabilistic sampling strategies, filtering out low-value differences and suppressing feedback noise. Subsequently, it generates corresponding difference signatures based on the differential level and difference type, and uses a control flow coding mechanism to map these signatures to new control flow paths in the coverage feedback. Because the gray-box fuzzing system can dynamically adjust the retention and mutation strategies of test inputs based on path changes, high-value protocol behavior differences can be transformed into higher-priority search targets, thereby guiding the testing process to continuously explore potential protocol semantic divergence regions.

[0102] This embodiment first filters the difference results based on their difference level. Since a large number of low-value differences may arise during protocol execution due to boundary fluctuations, local analytical discrepancies, or fine-grained observation events, this embodiment sets a difference level threshold, allowing only difference results that meet the preset level requirements to enter the subsequent feedback process. This approach prioritizes protocol behavior disagreements with higher semantic value while reducing the interference of low-value differences on the feedback system.

[0103] After completing the differential screening, this embodiment further constructs differential feedback coding. Specifically, this embodiment combines and encodes the differential level and differential feature information corresponding to the current test input to generate a differential feedback identifier that can uniquely characterize the current protocol behavior divergence. The differential feedback identifier retains both the difference intensity information and the difference source information, thereby enabling the differentiation of different types of protocol behavior divergences.

[0104] Subsequently, this embodiment utilizes a control flow mapping mechanism to convert the differential feedback identifiers into control flow changes recognizable by the fuzzing system. Specifically, this embodiment dynamically constructs corresponding control flow branches based on the differential feedback identifiers and perturbs preset feedback variables using conditional statements, causing different differential feedback identifiers to correspond to different program execution paths. Since the gray-box fuzzing system can identify changes in program execution paths through coverage monitoring mechanisms, the aforementioned manually constructed control flow changes will be recognized as new coverage feedback information, thereby allowing protocol behavior differences to enter the fuzzing framework in the form of control flow feedback.

[0105] S5. The differential feedback signal and the coverage feedback signal identified based on the control flow change are used together in the seed evaluation process. When the test input triggers a new differential feedback signal, the current test input is preferentially retained in the seed queue and the input evolution search is guided.

[0106] In an optional embodiment of the present invention, step S5 includes:

[0107] During the seed scheduling phase, if a test input triggers a differential feedback signal that is not recorded in the differential feedback bitmap, the energy allocation and mutation priority of the seed corresponding to that test input will be increased.

[0108] During the input mutation phase, the seeds that trigger high differential level feedback are mutated first to guide the fuzz test to explore the deep state space of the protocol behavior divergence region.

[0109] In this embodiment, after obtaining the differential feedback signal, the fuzzing system uses it together with the original coverage feedback in the seed evaluation process. When a test input can trigger a new differential feedback signal, this input will be preferentially retained in the seed queue and will have more opportunities for mutation in subsequent tests. Since higher differential levels usually correspond to more obvious protocol behavior divergences, this mechanism can prompt the fuzzing system to continuously focus on input regions that may trigger protocol state anomalies, protocol compatibility issues, and potential security vulnerabilities, thereby improving its ability to explore deep semantic paths of the protocol.

[0110] Through the above process, this embodiment achieves a complete closed loop from protocol execution, differential feature extraction, differential scoring to differential feedback guidance, such as... Figure 5As shown, for each test input, this embodiment can utilize the dual-implementation execution environment to generate protocol behavior differences, which are then structurally described through a differential feature set. After being quantified into differential levels by a differential scoring mechanism, these levels are further transformed into feedback signals perceptible to the fuzzing system through a differential coding guidance mechanism, further driving subsequent seed scheduling and input mutation processes. This forms a dynamic iterative search mechanism of "test input generation—dual-implementation execution—differential feature extraction—differential scoring—differential feedback coding—input evolution," enabling the fuzzing process to not only focus on program control flow coverage but also continuously perceive behavioral discrepancies at the protocol semantic level, thereby improving the ability to discover protocol implementation defects and potential vulnerabilities.

[0111] This invention provides an MQTT protocol gray-box fuzz testing system based on cross-implementation differential metrics, which applies the MQTT protocol gray-box fuzz testing method based on cross-implementation differential metrics as described above, including:

[0112] A dual-implementation execution environment construction module is used to construct a dual-implementation execution environment for the MQTT protocol. The dual-implementation execution environment includes a first execution instance and a second execution instance that share the same MQTT protocol processing logic, and their behavior is constructed by loading different protocol policy configuration files.

[0113] The differential feature extraction module is used to input the test input into the first execution instance and the second execution instance respectively, perform standardization processing on the generated execution behavior data, and extract differential feature sets from three dimensions: protocol semantic layer, structural behavior layer and fine-grained semantic observation layer.

[0114] The differential scoring module is used to quantitatively evaluate the differential feature set using a semantic-first weighted scoring method to obtain differential scoring results;

[0115] The differential feedback guidance module is used to generate a differential feedback signal based on the differential scoring result using a differential feedback coding mechanism, and to map the differential feedback signal into a control flow change that the fuzzy testing system can perceive; the differential feedback signal and the coverage feedback signal identified based on the control flow change are used together in the seed evaluation process; when the test input triggers a new differential feedback signal, the current test input is preferentially retained in the seed queue and the input evolution search is guided.

[0116] Compared with existing protocol gray-box fuzzing methods that rely solely on code coverage feedback, this invention introduces a cross-implementation behavior differential feedback mechanism to transform protocol processing results, state transition behaviors, and semantic discrepancies in message processing into quantifiable feedback signals. Furthermore, it works in conjunction with traditional coverage feedback, thereby significantly improving the protocol state space exploration capability and the ability to discover high-value test inputs.

[0117] This invention compares experimental results under different test modes and experimental data under different injection ratios, as shown in Tables 1 and 2. Figure 6 As shown.

[0118] Table 1: Comparison of Experimental Results under Different Test Modes

[0119] Baseline method 114.5 32.41% none none Differential feedback (without bitmap) 186.5 45.89% 200 / 0.70s 100 / 0.18s Differential Feedback Complete Model 192.0 48.75% 200 / 0.54s 100 / 0.17s

[0120] Table 2: Comparison of experimental data under different injection ratios

[0121] Benchmark Method 593.72 108 32.50% Differential feedback (no bitmap) 565.67 192 45.89% Differential feedback (injection ratio 25%) 516.03 195 48.75% Differential feedback (injection ratio 50%) 520.07 199 48.75% Differential feedback (injection ratio 75%) 493.05 184.5 48.75%

[0122] Experimental results show that, under the same testing conditions, the proposed differential feedback full model (diff_full) achieves better test results than the traditional coverage-guided method (Baseline). Specifically, the bitmap coverage increased from 32.41% to 48.75%, an improvement of 50.4%; the corpus size increased from 114.5 to 192.0, an increase of 67.7%, indicating that this invention can discover more test inputs with exploratory value and effectively expand the reachable state space of the protocol implementation.

[0123] Furthermore, compared to a control scheme that only employs differential execution without introducing coverage feedback, the coverage feedback and differential feedback fusion mechanism adopted in this invention further improves the coverage from 45.89% to 48.75%, demonstrating the good complementarity between traditional coverage information and cross-implementation behavior difference information. By combining the two types of feedback in the input selection and seed scheduling process, both program path exploration capability and protocol semantic behavior awareness capability can be taken into account, thereby improving the coverage effect of fuzz testing on complex protocol logic.

[0124] Furthermore, the differential scoring and feedback mechanism constructed in this invention exhibits high difference detection efficiency. During the experiment, the system was able to detect cross-implementation behavioral differences for the first time within 0.54 seconds and locate high-value differential inputs within 0.17 seconds. This demonstrates that the present invention can quickly identify test samples with potential semantic disagreements and promptly feed them back to the subsequent mutation process, thereby shortening the effective input discovery time and improving the efficiency of test resource utilization.

[0125] In terms of execution performance, since this invention requires maintaining dual execution environments and completing differential feature extraction and scoring calculation simultaneously, it incurs some additional overhead compared to traditional single-instance fuzzing methods. However, the overall execution efficiency decreases by approximately 8%. Experimental results show that this performance overhead is within an acceptable range, while the resulting improvements in coverage, state space expansion capabilities, and high-value input discovery capabilities are more significant, thus demonstrating a good performance-to-benefit ratio.

[0126] In summary, this invention achieves effective utilization of protocol semantic behavior differences by constructing a dual-implementation execution environment, a multi-dimensional differential feature extraction mechanism, a semantic-first differential measurement mechanism, and a differential feedback guidance mechanism. Compared with existing technologies, this invention not only improves the coverage and efficiency of protocol fuzz testing but also enhances the ability to discover deep state paths, inconsistent protocol implementation behaviors, and potential security vulnerabilities, demonstrating high engineering application value and promising prospects for widespread adoption.

[0127] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0128] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0129] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0130] Specific embodiments have been used to illustrate the principles and implementation methods of this invention. The descriptions of the embodiments above are only for the purpose of helping to understand the method and core ideas of this invention. At the same time, for those skilled in the art, there will be changes in the specific implementation methods and application scope based on the ideas of this invention. Therefore, the content of this specification should not be construed as a limitation of this invention.

[0131] Those skilled in the art will recognize that the embodiments described herein are intended to help the reader understand the principles of the invention, and should be understood that the scope of protection of the invention is not limited to such specific statements and embodiments. Those skilled in the art can make various other specific modifications and combinations based on the technical teachings disclosed in this invention without departing from the spirit of the invention, and these modifications and combinations are still within the scope of protection of this invention.

Claims

1. A gray-box fuzzy testing method for the MQTT protocol based on cross-implementation differential metrics, characterized in that, Includes the following steps: Construct a dual-implementation execution environment for the MQTT protocol; the dual-implementation execution environment includes a first execution instance and a second execution instance that share the same MQTT protocol processing logic, and their behavior is constructed by loading different protocol policy configuration files; The test input is fed into the first execution instance and the second execution instance respectively. The resulting execution behavior data is standardized and a differential feature set is extracted from three dimensions: protocol semantic layer, structural behavior layer and fine-grained semantic observation layer. The differential feature set is quantitatively evaluated using a semantic-first weighted scoring method to obtain differential scoring results; A differential feedback coding mechanism is used to generate a differential feedback signal based on the differential scoring result, and the differential feedback signal is mapped to a control flow change that the fuzzy testing system can perceive. The differential feedback signal and the coverage feedback signal identified based on control flow changes are used together in the seed evaluation process. When a test input triggers a new differential feedback signal, the current test input is preferentially retained in the seed queue and the input evolution search is guided.

2. The gray-box fuzzy testing method for the MQTT protocol based on cross-implementation differential metric as described in claim 1, characterized in that, Building a dual-implementation execution environment for the MQTT protocol includes: A lightweight protocol processing unit containing only the core protocol logic is extracted from the real MQTT broker server, and system-level components unrelated to the protocol semantics are removed, serving as the basic runtime environment for the first execution instance and the second execution instance; Configure different protocol policy configuration files for the first execution instance and the second execution instance respectively; the protocol policy configuration files describe the semantic difference behavior in the protocol processing process, including at least one of the following: exception message error code mapping policy, reconnection policy after disconnection, subscription option processing policy, and field lenient validation policy.

3. The gray-box fuzzy testing method for the MQTT protocol based on cross-implementation differential metric as described in claim 2, characterized in that, The lightweight protocol processing unit retains the functions related to message parsing, field validation, protocol state transition, and control message processing in the MQTT protocol, and removes network communication, multi-threaded scheduling, and persistent storage components.

4. The MQTT protocol gray-box fuzzy testing method based on cross-implementation differential metric as described in claim 3, characterized in that, Before the test inputs are entered into the first execution instance and the second execution instance respectively, the process also includes: The protocol status, runtime cache, and statistics of the lightweight protocol processing unit are initialized.

5. The gray-box fuzzy testing method for the MQTT protocol based on cross-implementation differential metric as described in claim 1, characterized in that, The test input is a control message of the MQTT protocol, which includes at least one of the following: connection message, publish message, subscribe message, unsubscribe message, and disconnect message.

6. The gray-box fuzzy testing method for the MQTT protocol based on cross-implementation differential metric as described in claim 1, characterized in that, The differential feature set extracted from three dimensions—protocol semantic layer, structural behavior layer, and fine-grained semantic observation layer—includes: In the protocol semantic layer, the execution results of the first execution instance and the second execution instance are compared, and the differences in return results and state transitions are extracted; In the structural behavior layer, the processing procedures of the first execution instance and the second execution instance are compared to extract the differences in the number of messages processed and the differences in the input consumption progress. In the fine-grained semantic observation layer, a semantic observation mechanism is used at key nodes of the protocol to extract the execution differences of message admission judgment events, field verification events, and state transition decision events.

7. The gray-box fuzzy testing method for the MQTT protocol based on cross-implementation differential metric as described in claim 1, characterized in that, The differential feature set is quantitatively evaluated using a semantic-first weighted scoring method to obtain differential scoring results, including: A first weight is assigned to the differences in return results and state transitions of the protocol semantic layer; a second weight is assigned to the differences in the number of messages processed and the input consumption progress of the structure behavior layer; and a third weight is assigned to the differences in execution of the fine-grained semantic observation layer; wherein the first weight is greater than the second weight, and the second weight is greater than the third weight. The initial difference score is obtained by weighted summation based on the difference values ​​of each dimension and their corresponding weights. The initial differential score is mapped to discrete differential levels using a hierarchical bucketing strategy to obtain the differential score result.

8. The gray-box fuzzy testing method for the MQTT protocol based on cross-implementation differential metric as described in claim 1, characterized in that, A differential feedback coding mechanism is used to generate a differential feedback signal based on the differential scoring result, and the differential feedback signal is mapped to a control flow change that the fuzzy testing system can perceive, including: The differential scoring results are filtered according to a preset differential level threshold, and low-value differences below the differential level threshold are filtered out. The selected differential levels are combined with the corresponding differential feature information and encoded to generate a unique differential feedback identifier; The differential feedback identifier is mapped to a new control flow path in the coverage feedback by using a control flow mapping mechanism, so that the differences in protocol behavior enter the fuzz testing framework in the form of control flow feedback.

9. The gray-box fuzzy testing method for the MQTT protocol based on cross-implementation differential metric as described in claim 1, characterized in that, The differential feedback signal and the coverage feedback signal identified based on control flow changes are jointly used in the seed evaluation process. When a test input triggers a new differential feedback signal, the current test input is preferentially retained in the seed queue and the input evolution search is guided, including: During the seed scheduling phase, if a test input triggers a differential feedback signal that is not recorded in the differential feedback bitmap, the energy allocation and mutation priority of the seed corresponding to that test input will be increased. During the input mutation phase, the seeds that trigger high differential level feedback are mutated first to guide the fuzz test to explore the deep state space of the protocol behavior divergence region.

10. A gray-box fuzz testing system for the MQTT protocol based on cross-implementation differential metrics, employing the gray-box fuzz testing method for the MQTT protocol based on cross-implementation differential metrics as described in any one of claims 1 to 9, characterized in that, include: A dual-implementation execution environment construction module is used to construct a dual-implementation execution environment for the MQTT protocol. The dual-implementation execution environment includes a first execution instance and a second execution instance that share the same MQTT protocol processing logic, and their behavior is constructed by loading different protocol policy configuration files. The differential feature extraction module is used to input the test input into the first execution instance and the second execution instance respectively, perform standardization processing on the generated execution behavior data, and extract differential feature sets from three dimensions: protocol semantic layer, structural behavior layer and fine-grained semantic observation layer. The differential scoring module is used to quantitatively evaluate the differential feature set using a semantic-first weighted scoring method to obtain differential scoring results; The differential feedback guidance module is used to generate a differential feedback signal based on the differential scoring result using a differential feedback coding mechanism, and to map the differential feedback signal into a control flow change that the fuzzy testing system can perceive; the differential feedback signal and the coverage feedback signal identified based on the control flow change are used together in the seed evaluation process; when the test input triggers a new differential feedback signal, the current test input is preferentially retained in the seed queue and the input evolution search is guided.

Images