We present a novel tool BertRLFuzzer, a BERT and Reinforcement Learning (RL) based fuzzer aimed at finding security vulnerabilities for Web applications. BertRLFuzzer works as follows: given a set of seed inputs, the fuzzer performs grammar-adhering and attack-provoking mutation operations on them to generate candidate attack vectors. The key insight of BertRLFuzzer is the use of RL with a BERT model as an agent to guide the fuzzer to efficiently learn grammar-adhering and attack-provoking mutation operators. In order to establish the efficacy of BertRLFuzzer we compare it against a total of 13 black box and white box fuzzers over a benchmark of 9 victim websites with over 16K LOC. We observed a significant improvement relative to the nearest competing tool in terms of time to first attack (54% less), new vulnerabilities found (17 new vulnerabilities), and attack rate (4.4% more attack vectors generated).

翻译：我们提出了一种新颖工具BertRLFuzzer，这是一种基于BERT（双向编码器表示）和强化学习（RL）的模糊测试器，旨在发现Web应用程序的安全漏洞。BertRLFuzzer的工作原理如下：给定一组种子输入，模糊测试器对其执行遵循语法规范且可诱发攻击的变异操作，以生成候选攻击向量。BertRLFuzzer的核心洞察在于利用强化学习结合BERT模型作为智能体，引导模糊测试器高效学习遵循语法规范且可诱发攻击的变异算子。为验证BertRLFuzzer的有效性，我们将其与总计13个黑盒及白盒模糊测试器进行对比，基准测试涵盖9个目标网站（代码量超过1.6万行）。实验表明，与最接近的竞争工具相比，我们在首次攻击时间（减少54%）、新发现漏洞（17个新增漏洞）及攻击效率（生成的攻击向量增加4.4%）方面取得了显著改进。