.png){kind=icon}
返回
Generative Pre-Trained Transformer-Based Reinforcement Learning for Testing Web Application Firewalls
.png){kind=icon}
PRE
AI
DOI：10.1109/TDSC.2023.3252523.png)
.png){kind=icon}
原文求助.png){kind=icon}
分享.png){kind=icon}
收藏
摘要
En 中文
Web Application Firewalls (WAFs) are widely deployed to protect key web applications against multiple security threats, so it is important to test WAFs regularly to prevent attackers from bypassing them easily. Machine-learning-based black-box WAF testing is gaining more attention, though existing learning-based approaches have strict requirements on the source and scale of payload data and suffer from the local optimum problem, limiting their effectiveness and practical application. We propose GPTFuzzer, a practical and effective generation-based approach to test WAFs by generating attack payloads token-by-token. Specifically, we fine-tune a Generative Pre-trained Transformer language model with reinforcement learning to make GPTFuzzer have the least restrictions on payload data and thus more applicable in practice, and we use reward modeling and KL-divergence penalty to improve the effectiveness of our approach and mitigate the local optimum issue. We implement GPTFuzzer and evaluate it on two well-known open-source WAFs against three kinds of common attacks. Experimental results show that GPTFuzzer significantly outperforms state-of-the-art approaches, i.e., ML-Driven and RAT, finding up to 7.8x (3.2x on average) more bypassing payloads within 1,250,000 requests, or finding out all bypassing payloads using up to 8.1x (3.3x on average) fewer requests.
Keyword:
Payloads
Grammar
Testing
Reinforcement learning
Data models
Adaptation models
Security
Black-box testing
reinforcement learning
transformer
web application firewall
期刊
IF:
7.5
论文数:
2.4K
被引数:
9.6K
机构
引用论文
分享收藏
Temporal variation in the diet of a coral reef piscivore (Pisces: Serranidae) was not seasonal.png)
Coral Reefs
Coral ReefsIF0
PREAI
分享收藏
查看更多内容