We present a novel tool BertRLFuzzer, a BERT and Reinforcement Learning (RL) based fuzzer aimed at finding security vulnerabilities for Web applications. BertRLFuzzer works as follows: given a set of seed inputs, the fuzzer performs grammar-adhering and attack-provoking mutation operations on them to generate candidate attack vectors. The key insight of BertRLFuzzer is the use of RL with a BERT model as an agent to guide the fuzzer to efficiently learn grammar-adhering and attack-provoking mutation operators. In order to establish the efficacy of BertRLFuzzer we compare it against a total of 13 black box and white box fuzzers over a benchmark of 9 victim websites with over 16K LOC. We observed a significant improvement relative to the nearest competing tool in terms of time to first attack (54% less), new vulnerabilities found (17 new vulnerabilities), and attack rate (4.4% more attack vectors generated).

翻译：我们提出了一种新颖的工具BertRLFuzzer，这是一种基于BERT和强化学习的模糊测试器，旨在发现Web应用的安全漏洞。BertRLFuzzer的工作流程如下：给定一组种子输入，该模糊测试器对其执行遵循语法且诱发攻击的变异操作，以生成候选攻击向量。BertRLFuzzer的核心创新在于将强化学习与BERT模型作为智能体相结合，以引导模糊测试器高效学习遵循语法且诱发攻击的变异算子。为验证BertRLFuzzer的有效性，我们在包含9个目标网站（代码量超过1.6万行）的基准测试集上，将其与总共13个黑盒和白盒模糊测试器进行对比。实验表明，与最接近的竞争工具相比，我们观察到显著改进：首次攻击时间减少54%，发现新漏洞17个，攻击率提升4.4%（生成更多攻击向量）。