Related Experiment Video
Updated: Dec 8, 2025
08:15
Data Communication Based on MQTT in a Polymer Extrusion Process
Published on: July 15, 2022
3.7K
MultiFuzz: A Coverage-Based Multiparty-Protocol Fuzzer for IoT Publish/Subscribe Protocols
Yingpei Zeng1,2, Mingmin Lin1, Shanqing Guo3
1School of Cyberspace, Hangzhou Dianzi University, Hangzhou 310000, China.
Sensors (Basel, Switzerland)
|September 16, 2020
Summary
MultiFuzz, a novel fuzzer, enhances the testing of multiparty protocols like MQTT and CoAP in IoT networks. It effectively uncovers more software vulnerabilities by addressing limitations in existing coverage-based fuzzing tools.
Area of Science:
- Computer Science
- Network Security
- Software Engineering
Background:
- The publish/subscribe model is crucial for Internet of Things (IoT) networks, with protocols like Message Queue Telemetry Transport (MQTT) and Constrained Application Protocol (CoAP) being widely adopted.
- Existing coverage-based fuzzing tools often fail to adequately test multiparty protocols due to their assumption of only two interacting parties, whereas IoT protocols involve three: publisher, subscriber, and broker.
- This limitation can lead to missed vulnerabilities in complex IoT communication scenarios.
Purpose of the Study:
- To introduce MultiFuzz, a new coverage-based fuzzer specifically designed for multiparty protocols.
- To overcome the limitations of traditional fuzzers in handling the complexities of IoT publish/subscribe architectures.
- To improve the efficiency and effectiveness of vulnerability discovery in IoT network protocols.
Main Methods:
- MultiFuzz embeds multiple-connection information within a single input to simulate complex interactions.
- It employs a novel message mutation algorithm that stimulates protocol state transitions without requiring protocol specifications.
- A specialized `desockmulti` module efficiently feeds network messages to the program under test, achieving 10x speed improvement over similar tools.
Main Results:
- MultiFuzz was implemented based on the AFL fuzzer and successfully tested Eclipse Mosquitto and libCoAP.
- The fuzzer identified and reported previously unknown issues to the respective projects.
- Comparative analysis showed MultiFuzz discovering significantly more code paths and crashes than AFL, MOPT, and AFLNET.
Conclusions:
- MultiFuzz represents a significant advancement in fuzzing technology for multiparty IoT protocols.
- Its unique approach effectively addresses the challenges posed by the publisher-subscriber-broker interaction model.
- The tool demonstrates superior performance in uncovering vulnerabilities, enhancing the security of IoT systems.
Keywords:
CoAPIoTMQTTPreenycoverage-based fuzzingdesockmultiparty-protocol fuzzernetwork protocolpublish/subscribesecurityMore Related Videos
Related Concept Videos
02:28Leaky Scanning
5.5K
During most eukaryotic translation processes, the small 40S ribosome subunit scans an mRNA from its 5' end until it encounters the first start AUG codon. The large 60S ribosomal subunit then joins the smaller one to initiate protein synthesis. The location of the translation initiation is largely determined by the nucleotides near the start codon as there may be multiple translation initiation sites present on the mRNA. Marilyn Kozak discovered that the sequence RCCAUGG (where R...
5.5K
01:25Network Function of a Circuit
512
Frequency response analysis in electrical circuits provides vital insights into a circuit's behavior as the frequency of the input signal changes. The transfer function, a mathematical tool, is instrumental in understanding this behavior. It defines the relationship between phasor output and input and comes in four types: voltage gain, current gain, transfer impedance, and transfer admittance. The critical components of the transfer function are the poles and zeros.
512
01:10Propagation of Uncertainty from Systematic Error
1.2K
The atomic mass of an element varies due to the relative ratio of its isotopes. A sample's relative proportion of oxygen isotopes influences its average atomic mass. For instance, if we were to measure the atomic mass of oxygen from a sample, the mass would be a weighted average of the isotopic masses of oxygen in that sample. Since a single sample is not likely to perfectly reflect the true atomic mass of oxygen for all the molecules of oxygen on Earth, the mass we obtain from this...
1.2K
00:59Propagation of Uncertainty from Random Error
1.5K
An experiment often consists of more than a single step. In this case, measurements at each step give rise to uncertainty. Because the measurements occur in successive steps, the uncertainty in one step necessarily contributes to that in the subsequent step. As we perform statistical analysis on these types of experiments, we must learn to account for the propagation of uncertainty from one step to the next. The propagation of uncertainty depends on the type of arithmetic operation performed on...
1.5K
01:26Signal and System
1.4K
A signal x(t) is a set of data or a time function representing a variable of interest. Signals typically convey information about a phenomenon, such as atmospheric temperature, humidity, human voice, television images, a dog's bark, or birdsongs. More generally, a signal can be a function of more than one independent variable. For instance, images depend on horizontal and vertical positions and can be regarded as two-dimensional signals. However, this text will focus on one-dimensional...
1.4K
01:14Clamper Circuit
812
A clamper circuit, also known as a DC restorer, represents a specialized variant of the rectifier circuit, notable for its method of taking the output across the diode rather than the capacitor. This configuration lends to several distinctive applications, particularly in handling square wave inputs.
Within this circuit, the diode's orientation prompts the capacitor to charge up to the level of the most negative peak of the input signal. Upon reaching this state, the diode ceases to...
Within this circuit, the diode's orientation prompts the capacitor to charge up to the level of the most negative peak of the input signal. Upon reaching this state, the diode ceases to...
812