{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,3,25]],"date-time":"2026-03-25T21:07:12Z","timestamp":1774472832437,"version":"3.50.1"},"reference-count":48,"publisher":"Wiley","issue":"1","license":[{"start":{"date-parts":[[2018,2,26]],"date-time":"2018-02-26T00:00:00Z","timestamp":1519603200000},"content-version":"vor","delay-in-days":56,"URL":"http:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"content-domain":{"domain":["onlinelibrary.wiley.com"],"crossmark-restriction":true},"short-container-title":["Wireless Communications and Mobile Computing"],"published-print":{"date-parts":[[2018,1]]},"abstract":"<jats:p>The Internet of Things is a concept that is increasingly present in our lives. The emergence of intelligent devices has led to a paradigm shift in the way technology interacts with the environment, leading society to a smarter planet. Consequently, new advanced telemetry approaches appear to connect all kinds of devices with each other, with companies, or with other networks, such as the Internet. On the road to an increasingly interconnected world, where critical devices rely on communication networks to provide an essential service, there arises the need to ensure the security and reliability of these protocols and applications. In this paper, we discuss a security\u2010based approach for MQTT (Message Queue Telemetry Transport), which stands out as a very lightweight and widely used messaging and information exchange protocol for IoT (Internet of Things) devices throughout the world. To that end, we propose the creation of a framework that allows for performing a novel, template\u2010based fuzzing technique on the MQTT protocol. The first experimental results showed that performance of the fuzzing technique presented here makes it a good candidate for use in network architectures with low processing power sensors, such as Smart Cities. In addition, the use of this fuzzer in widely used applications that implement MQTT has led to the discovery of several new security flaws not hitherto reported, demonstrating its usefulness as a tool for finding security vulnerabilities.<\/jats:p>","DOI":"10.1155\/2018\/8261746","type":"journal-article","created":{"date-parts":[[2018,2,26]],"date-time":"2018-02-26T23:36:08Z","timestamp":1519688168000},"update-policy":"https:\/\/doi.org\/10.1002\/crossmark_policy","source":"Crossref","is-referenced-by-count":42,"title":["MQTT Security: A Novel Fuzzing Approach"],"prefix":"10.1155","volume":"2018","author":[{"ORCID":"https:\/\/orcid.org\/0000-0002-9198-1830","authenticated-orcid":false,"given":"Santiago","family":"Hern\u00e1ndez Ramos","sequence":"first","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"M. Teresa","family":"Villalba","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-4773-4904","authenticated-orcid":false,"given":"Raquel","family":"Lacuesta","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"311","published-online":{"date-parts":[[2018,2,26]]},"reference":[{"key":"e_1_2_9_1_2","doi-asserted-by":"publisher","DOI":"10.1016\/j.bushor.2015.03.008"},{"key":"e_1_2_9_2_2","doi-asserted-by":"crossref","unstructured":"ChowdhuryB.andChowdhuryM. U. RFID-based real-time smart waste management system Proceedings of the In 2007 Australasian Telecommunication Networks and Applications Conference 2007 175\u2013180 https:\/\/doi.org\/10.1109\/ATNAC.2007.IEEE.","DOI":"10.1109\/ATNAC.2007.4665232"},{"key":"e_1_2_9_3_2","doi-asserted-by":"publisher","DOI":"10.18535\/ijecs\/v5i9.23"},{"key":"e_1_2_9_4_2","doi-asserted-by":"publisher","DOI":"10.1177\/1460458216660754"},{"key":"e_1_2_9_5_2","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-26410-3_19"},{"key":"e_1_2_9_6_2","doi-asserted-by":"crossref","unstructured":"DepuruS. S. S. R. WangL. DevabhaktuniV. andGudiN. Smart meters for power grid - Challenges issues advantages and status Proceedings of the 2011 IEEE\/PES Power Systems Conference and Exposition PSCE 2011 March 2011 USA 2-s2.0-79958784687 https:\/\/doi.org\/10.1109\/PSCE.2011.5772451.","DOI":"10.1109\/PSCE.2011.5772451"},{"key":"e_1_2_9_7_2","doi-asserted-by":"publisher","DOI":"10.1016\/j.comnet.2012.12.018"},{"key":"e_1_2_9_8_2","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-47063-4_48"},{"key":"e_1_2_9_9_2","doi-asserted-by":"publisher","DOI":"10.1109\/JIOT.2017.2683200"},{"key":"e_1_2_9_10_2","doi-asserted-by":"crossref","unstructured":"YasseinM. B. ShatnawiM. Q. andAl-ZoubiD. Application layer protocols for the Internet of Things: A survey Proceedings of the 2016 International Conference on Engineering and MIS ICEMIS 2016 September 2016 mar 2-s2.0-85002606367 https:\/\/doi.org\/10.1109\/ICEMIS.2016.7745303.","DOI":"10.1109\/ICEMIS.2016.7745303"},{"key":"e_1_2_9_11_2","doi-asserted-by":"publisher","DOI":"10.1002\/sec.628"},{"key":"e_1_2_9_12_2","volume-title":"Fuzzing: brute force vulnerabilty discovery","author":"Sutton M.","year":"2007"},{"key":"e_1_2_9_13_2","doi-asserted-by":"publisher","DOI":"10.1002\/sec.628"},{"key":"e_1_2_9_14_2","unstructured":"HiveMQ Enterprise MQTT Broker 2016 https:\/\/www.hivemq.com\/wp-content\/uploads\/hivemq-product-sheet-v2-1.pdf."},{"key":"e_1_2_9_15_2","unstructured":"HiveMQ https:\/\/www.hivemq.com\/blog\/mqtt-security-fundamentals-authenticationusername-password."},{"key":"e_1_2_9_16_2","doi-asserted-by":"crossref","unstructured":"HediI. \u0160pehI. and\u0160arabokA. IoT network protocols comparison for the purpose of IoT constrained networks Proceedings of the 40th International Convention on Information and Communication Technology Electronics and Microelectronics MIPRO 2017 May 2017 Croatia 501\u2013505 2-s2.0-85027710297 https:\/\/doi.org\/10.23919\/MIPRO.2017.7973477.","DOI":"10.23919\/MIPRO.2017.7973477"},{"key":"e_1_2_9_17_2","doi-asserted-by":"publisher","DOI":"10.1007\/s11277-011-0385-5"},{"key":"e_1_2_9_18_2","doi-asserted-by":"publisher","DOI":"10.1109\/JIOT.2017.2737630"},{"key":"e_1_2_9_19_2","doi-asserted-by":"crossref","unstructured":"NeisseR. SteriG. andBaldiniG. Enforcement of security policy rules for the internet of things Proceedings of the 2014 10th IEEE International Conference on Wireless and Mobile Computing Networking and Communications WiMob 2014 October 2014 Cyprus 165\u2013172 2-s2.0-84917692605 https:\/\/doi.org\/10.1109\/WiMOB.2014.6962166.","DOI":"10.1109\/WiMOB.2014.6962166"},{"key":"e_1_2_9_20_2","doi-asserted-by":"crossref","unstructured":"ShinS. KobaraK. ChuangC.-C. andHuangW. A security framework for MQTT Proceedings of the 2016 IEEE Conference on Communications and Network Security CNS 2016 October 2016 USA 432\u2013436 2-s2.0-85015985027 https:\/\/doi.org\/10.1109\/CNS.2016.7860532.","DOI":"10.1109\/CNS.2016.7860532"},{"key":"e_1_2_9_21_2","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-33124-9_1"},{"key":"e_1_2_9_22_2","doi-asserted-by":"publisher","DOI":"10.1016\/B978-1-932266-67-2.X5031-2"},{"key":"e_1_2_9_23_2","unstructured":"KasperskyK.andChangA. Remote code execution through Intel CPU bugs Proceedings of the In Hack In The Box (HITB) 2008 Malaysia."},{"key":"e_1_2_9_24_2","doi-asserted-by":"crossref","unstructured":"ReyndersD. MackayS. andWrightE. Modbus overview. Practical Industrial Data Communications 2004 10.1016\/b978--3\/50012-7","DOI":"10.1016\/B978-075066395-3\/50012-7"},{"key":"e_1_2_9_24_3","doi-asserted-by":"crossref","unstructured":"https:\/\/doi.org\/10.1016\/b978-075066395-3\/50012-7.","DOI":"10.1016\/B978-075066395-3\/50012-7"},{"key":"e_1_2_9_25_2","first-page":"77","volume-title":"In Internet-of-Things (IoT) Systems","author":"Serpanos D.","year":"2017"},{"key":"e_1_2_9_26_2","volume-title":"The advantages of block-based protocol analysis for security testing","author":"Aitel D.","year":"2002"},{"key":"e_1_2_9_27_2","unstructured":"PereydaJ. boofuzz: Network Protocol Fuzzing for Humans http:\/\/boofuzz.readthedocs.io\/en\/latest\/."},{"key":"e_1_2_9_28_2","first-page":"343","article-title":"SNOOZE: Toward a Stateful NetwOrk prOtocol fuzZEr","volume":"4176","author":"Banks G.","year":"2006","journal-title":"Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics): Preface"},{"key":"e_1_2_9_29_2","doi-asserted-by":"crossref","unstructured":"AbdelnurH. J. StateR. andFestorO. KiF: A stateful SIP fuzzer Proceedings of the 1st International Conference on Principles Systems and Applications of IP Telecommunications IPTComm \u203207 July 2007 USA 47\u201356 2-s2.0-56549118700 https:\/\/doi.org\/10.1145\/1326304.1326313.","DOI":"10.1145\/1326304.1326313"},{"key":"e_1_2_9_30_2","volume-title":"AutoFuzz, Automated network protocol fuzzing framework","author":"Gorbunov S.","year":"2010"},{"key":"e_1_2_9_31_2","unstructured":"AitelD. An Introduction to SPIKE the Fuzzer Creation Kit https:\/\/www.blackhat.com\/presentations\/bh-usa-02\/bh-us-02-aitel-spike.ppt."},{"key":"e_1_2_9_32_2","unstructured":"Github.org mqtt_fuzz https:\/\/github.com\/F-Secure\/mqtt_fuzz."},{"key":"e_1_2_9_33_2","unstructured":"MladenovK. van WinsenS. MavrakisC. andCyberK. P. M. G. Formal verification of the implementation of the MQTT protocol in IoT devices ."},{"key":"e_1_2_9_34_2","unstructured":"OWASP.org ZAP Proxy http:\/\/www.zaproxy.org\/."},{"key":"e_1_2_9_35_2","unstructured":"PortsWigger.net BurpSuite https:\/\/portswigger.net\/bur."},{"key":"e_1_2_9_36_2","unstructured":"Github.com ProxyFuzz https:\/\/github.com\/SECFORCE\/proxyfuz."},{"key":"e_1_2_9_37_2","unstructured":"LandauerL. Fuzzing Requests And Responses Using A Proxy U.S. Patent Application No. 11\/276 454."},{"key":"e_1_2_9_38_2","unstructured":"OASIS.org MQTTVersion3.1.1:OASISStandard http:\/\/docs.oasis-open.org\/mqtt\/mqtt\/v3.1.1\/os\/mqtt-v3.1.1-os.html."},{"key":"e_1_2_9_39_2","article-title":"Fuzzing for Software Security Testing and Quality Assurance , Artech House Information Security and Privacy","author":"Takanen A.","year":"2008","journal-title":"Fuzzing for Software Security Testing and Quality Assurance , Artech House Information Security and Privacy"},{"key":"e_1_2_9_40_2","doi-asserted-by":"crossref","unstructured":"SofokleousA. A.andAndreouA. S. Batch-optimistic test-cases generation using genetic algorithms Proceedings of the 19th IEEE International Conference on Tools with Artificial Intelligence ICTAI 2007 October 2007 Greece 157\u2013164 2-s2.0-48649103354 https:\/\/doi.org\/10.1109\/ICTAI.2007.113.","DOI":"10.1109\/ICTAI.2007.113"},{"key":"e_1_2_9_41_2","doi-asserted-by":"crossref","unstructured":"AbbassiR. GuemaraS. andElF. Towards a test cases generation method for security policies Proceedings of the 16th International Conference on Telecommunications ICT 2009 May 2009 Morocco 41\u201346 2-s2.0-77950681125 https:\/\/doi.org\/10.1109\/ICTEL.2009.5158616.","DOI":"10.1109\/ICTEL.2009.5158616"},{"key":"e_1_2_9_42_2","unstructured":"Python.org Argparse https:\/\/docs.python.org\/3.4\/library\/argparse.html."},{"key":"e_1_2_9_43_2","doi-asserted-by":"publisher","DOI":"10.4172\/jcsb.1000182"},{"key":"e_1_2_9_44_2","article-title":"Netfilter and IPTables - A Structural Examination","author":"Alan J.","year":"2004","journal-title":"SANS Institute"},{"key":"e_1_2_9_45_2","unstructured":"Netfilter.org Netfilter https:\/\/www.netfilter.org\/."},{"key":"e_1_2_9_46_2","unstructured":"University of Oulu Radamsa https:\/\/www.ee.oulu.fi\/roles\/ouspg\/Radams."},{"key":"e_1_2_9_47_2","unstructured":"Scapy.org MQTT layer for Scapy https:\/\/goo.gl\/oo45XC."}],"container-title":["Wireless Communications and Mobile Computing"],"original-title":[],"language":"en","link":[{"URL":"http:\/\/downloads.hindawi.com\/journals\/wcmc\/2018\/8261746.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"text-mining"},{"URL":"http:\/\/downloads.hindawi.com\/journals\/wcmc\/2018\/8261746.xml","content-type":"application\/xml","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/onlinelibrary.wiley.com\/doi\/pdf\/10.1155\/2018\/8261746","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2024,8,7]],"date-time":"2024-08-07T06:47:46Z","timestamp":1723013266000},"score":1,"resource":{"primary":{"URL":"https:\/\/onlinelibrary.wiley.com\/doi\/10.1155\/2018\/8261746"}},"subtitle":[],"editor":[{"given":"Syed H.","family":"Ahmed","sequence":"additional","affiliation":[],"role":[{"role":"editor","vocabulary":"crossref"}]}],"short-title":[],"issued":{"date-parts":[[2018,1]]},"references-count":48,"journal-issue":{"issue":"1","published-print":{"date-parts":[[2018,1]]}},"alternative-id":["10.1155\/2018\/8261746"],"URL":"https:\/\/doi.org\/10.1155\/2018\/8261746","archive":["Portico"],"relation":{},"ISSN":["1530-8669","1530-8677"],"issn-type":[{"value":"1530-8669","type":"print"},{"value":"1530-8677","type":"electronic"}],"subject":[],"published":{"date-parts":[[2018,1]]},"assertion":[{"value":"2017-09-30","order":0,"name":"received","label":"Received","group":{"name":"publication_history","label":"Publication History"}},{"value":"2018-01-10","order":2,"name":"accepted","label":"Accepted","group":{"name":"publication_history","label":"Publication History"}},{"value":"2018-02-26","order":3,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}],"article-number":"8261746"}}