Deep Reinforcement Fuzzing

Understand

Fuzzing is the process of finding security vulnerabilities in input-processing code by repeatedly testing the code with modified inputs.

• In this paper, we formalize fuzzing as a reinforcement learning problem using the concept of Markov decision processes.
• This in turn allows us to apply state-of-the-art deep Q-learning algorithms that optimize rewards, which we define from runtime properties of the program under test.
• By observing the rewards caused by mutating with a specific set of actions performed on an initial program input, the fuzzing agent learns a policy that can next generate new higher-reward inputs.