摘要： HTTP协议作为互联网通信的核心基础设施，其现代通信模型依赖多服务器协同工作。若处理链中的服务器未严格遵循协议规范或存在语义解释差异，将引发系统性特征的语义不一致问题，导致访问控制绕过、多Host问题、请求走私及缓存污染等安全威胁。差分模糊测试通过观测不同服务器对报文处理结果的差异，分析语义不一致问题。为了解决现有工具中字段集合范围失准、突变效率低、观测维度单一的问题，提出了一种改进的差分模糊测试方法。首先，基于关键首部的报文构建方法，筛选核心字段精简测试空间；基于字段语义的突变方法，结合语义分类与漏洞特征设计突变方法，丰富测试用例；扩展的报文分析方法，扩展报文分析范围至请求和响应报文，完整地观测通信过程，覆盖现有语义不一致问题的场景。最后，针对常用的7款服务器进行测试，分析发现18类服务器处理差异问题并验证出9对存在语义不一致问题的组合。相比同类工具t-reqs，将测试集合规模降低一个数量级，平均提升12.67%的有效测试用例占比，在同样的观测角度下额外发现2类新的差异问题，扩展测试范围覆盖当前语义不一致问题的四类场景。

Abstract: HTTP protocol is the core infrastructure of Internet communication, and its modern communication model relies on the collaboration of multiple servers. If the servers in the processing chain do not strictly follow the protocol specifications or have differences in semantic interpretation, it will cause semantic inconsistency problems of systemic characteristics, leading to security threats such as access control bypass, multi-host problems, request smuggling and cache pollution. Differential fuzz testing analyzes semantic inconsistency problems by observing the differences in message processing results of different servers. In order to solve the problems of inaccurate field set range, low mutation efficiency and single observation dimension in existing tools, an improved differential fuzz testing method is proposed. First, based on the message construction method of key headers, the core fields are selected to simplify the test space; based on the mutation method of field semantics, the mutation method is designed by combining semantic classification and vulnerability characteristics to enrich test cases; the extended message analysis method expands the message analysis scope to request and response messages, fully observes the communication process, and covers the existing scenarios of semantic inconsistency problems. Finally, tests are conducted on 7 commonly used servers, and 18 types of server processing differences are found and 9 pairs of combinations with semantic inconsistency problems are verified. Compared with similar tools such as t-reqs, it reduces the size of the test set by an order of magnitude, increases the average proportion of valid test cases by 12.67%, discovers two additional types of difference problems from the same observation angle, and expands the test scope to cover four scenarios of current semantic inconsistency problems.