arXivDaily arXiv每日学术速递 周一至周五更新
arXiv 1801.04589cs.AIcs.CR
收藏

Deep Reinforcement Fuzzing

Fraunhofer AISEC(弗劳恩霍夫应用与集成安全研究所);Microsoft Research(微软研究院)

Konstantin Böttinger, Patrice Godefroid, Rishabh Singh

英文摘要:

Fuzzing is the process of finding security vulnerabilities in input-processing code by repeatedly testing the code with modified inputs. In this paper, we formalize fuzzing as a reinforcement learning problem using the concept of Markov decision processes. This in turn allows us to apply state-of-the-art deep Q-learning algorithms that optimize rewards, which we define from runtime properties of the program under test. By observing the rewards caused by mutating with a specific set of actions performed on an initial program input, the fuzzing agent learns a policy that can next generate new higher-reward inputs. We have implemented this new approach, and preliminary empirical evidence shows that reinforcement fuzzing can outperform baseline random fuzzing.

机构、总结、中文摘要均由AI分析而来,可能存在错误,请以论文正文为准。

↑