{"id":"https://openalex.org/W4323338673","doi":"https://doi.org/10.1109/tdsc.2023.3252523","title":"Generative Pre-Trained Transformer-Based Reinforcement Learning for Testing Web Application Firewalls","display_name":"Generative Pre-Trained Transformer-Based Reinforcement Learning for Testing Web Application Firewalls","publication_year":2023,"publication_date":"2023-03-06","ids":{"openalex":"https://openalex.org/W4323338673","doi":"https://doi.org/10.1109/tdsc.2023.3252523"},"language":"en","primary_location":{"id":"doi:10.1109/tdsc.2023.3252523","is_oa":false,"landing_page_url":"https://doi.org/10.1109/tdsc.2023.3252523","pdf_url":null,"source":{"id":"https://openalex.org/S133795288","display_name":"IEEE Transactions on Dependable and Secure Computing","issn_l":"1545-5971","issn":["1545-5971","1941-0018","2160-9209"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310320439","host_organization_name":"IEEE Computer Society","host_organization_lineage":["https://openalex.org/P4310320439","https://openalex.org/P4310319808"],"host_organization_lineage_names":["IEEE Computer Society","Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Transactions on Dependable and Secure Computing","raw_type":"journal-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5100354105","display_name":"Hongliang Liang","orcid":"https://orcid.org/0000-0001-6877-780X"},"institutions":[{"id":"https://openalex.org/I139759216","display_name":"Beijing University of Posts and Telecommunications","ror":"https://ror.org/04w9fbh59","country_code":"CN","type":"education","lineage":["https://openalex.org/I139759216"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Hongliang Liang","raw_affiliation_strings":["Trusted Software and Intelligent System Lab, Beijing University of Posts and Telecommunications, Beijing, China"],"raw_orcid":"https://orcid.org/0000-0001-6877-780X","affiliations":[{"raw_affiliation_string":"Trusted Software and Intelligent System Lab, Beijing University of Posts and Telecommunications, Beijing, China","institution_ids":["https://openalex.org/I139759216"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5100460319","display_name":"Xiangyu Li","orcid":"https://orcid.org/0000-0002-7060-2416"},"institutions":[{"id":"https://openalex.org/I139759216","display_name":"Beijing University of Posts and Telecommunications","ror":"https://ror.org/04w9fbh59","country_code":"CN","type":"education","lineage":["https://openalex.org/I139759216"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Xiangyu Li","raw_affiliation_strings":["Trusted Software and Intelligent System Lab, Beijing University of Posts and Telecommunications, Beijing, China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Trusted Software and Intelligent System Lab, Beijing University of Posts and Telecommunications, Beijing, China","institution_ids":["https://openalex.org/I139759216"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5006777086","display_name":"Da Xiao","orcid":"https://orcid.org/0009-0008-2732-5776"},"institutions":[{"id":"https://openalex.org/I139759216","display_name":"Beijing University of Posts and Telecommunications","ror":"https://ror.org/04w9fbh59","country_code":"CN","type":"education","lineage":["https://openalex.org/I139759216"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Da Xiao","raw_affiliation_strings":["Trusted Software and Intelligent System Lab, Beijing University of Posts and Telecommunications, Beijing, China"],"raw_orcid":"https://orcid.org/0009-0008-2732-5776","affiliations":[{"raw_affiliation_string":"Trusted Software and Intelligent System Lab, Beijing University of Posts and Telecommunications, Beijing, China","institution_ids":["https://openalex.org/I139759216"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5100454052","display_name":"Jie Liu","orcid":"https://orcid.org/0000-0002-0750-1030"},"institutions":[{"id":"https://openalex.org/I139759216","display_name":"Beijing University of Posts and Telecommunications","ror":"https://ror.org/04w9fbh59","country_code":"CN","type":"education","lineage":["https://openalex.org/I139759216"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Jie Liu","raw_affiliation_strings":["Trusted Software and Intelligent System Lab, Beijing University of Posts and Telecommunications, Beijing, China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Trusted Software and Intelligent System Lab, Beijing University of Posts and Telecommunications, Beijing, China","institution_ids":["https://openalex.org/I139759216"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5068915028","display_name":"Yanjie Zhou","orcid":"https://orcid.org/0000-0003-2222-9140"},"institutions":[{"id":"https://openalex.org/I139759216","display_name":"Beijing University of Posts and Telecommunications","ror":"https://ror.org/04w9fbh59","country_code":"CN","type":"education","lineage":["https://openalex.org/I139759216"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Yanjie Zhou","raw_affiliation_strings":["Trusted Software and Intelligent System Lab, Beijing University of Posts and Telecommunications, Beijing, China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Trusted Software and Intelligent System Lab, Beijing University of Posts and Telecommunications, Beijing, China","institution_ids":["https://openalex.org/I139759216"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5009200537","display_name":"Aibo Wang","orcid":null},"institutions":[{"id":"https://openalex.org/I139759216","display_name":"Beijing University of Posts and Telecommunications","ror":"https://ror.org/04w9fbh59","country_code":"CN","type":"education","lineage":["https://openalex.org/I139759216"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Aibo Wang","raw_affiliation_strings":["Trusted Software and Intelligent System Lab, Beijing University of Posts and Telecommunications, Beijing, China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Trusted Software and Intelligent System Lab, Beijing University of Posts and Telecommunications, Beijing, China","institution_ids":["https://openalex.org/I139759216"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5101470389","display_name":"Jin Li","orcid":"https://orcid.org/0009-0006-2316-9169"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Jin Li","raw_affiliation_strings":["Nation Key Laboratory of Science and Technology on Information System Security, Beijing, China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Nation Key Laboratory of Science and Technology on Information System Security, Beijing, China","institution_ids":[]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":1,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":5.4395,"has_fulltext":false,"cited_by_count":31,"citation_normalized_percentile":{"value":0.96201396,"is_in_top_1_percent":false,"is_in_top_10_percent":true},"cited_by_percentile_year":{"min":96,"max":100},"biblio":{"volume":"21","issue":"1","first_page":"309","last_page":"324"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9940999746322632,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9940999746322632,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12326","display_name":"Network Packet Processing and Optimization","score":0.9851999878883362,"subfield":{"id":"https://openalex.org/subfields/1708","display_name":"Hardware and Architecture"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12479","display_name":"Web Application Security Vulnerabilities","score":0.9811999797821045,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.7589136958122253},{"id":"https://openalex.org/keywords/reinforcement-learning","display_name":"Reinforcement learning","score":0.6781256794929504},{"id":"https://openalex.org/keywords/security-token","display_name":"Security token","score":0.6431384086608887},{"id":"https://openalex.org/keywords/artificial-intelligence","display_name":"Artificial intelligence","score":0.5518327355384827},{"id":"https://openalex.org/keywords/machine-learning","display_name":"Machine learning","score":0.48307040333747864},{"id":"https://openalex.org/keywords/payload","display_name":"Payload (computing)","score":0.44433942437171936},{"id":"https://openalex.org/keywords/generative-model","display_name":"Generative model","score":0.42076346278190613},{"id":"https://openalex.org/keywords/generative-grammar","display_name":"Generative grammar","score":0.2161538302898407},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.18703654408454895}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7589136958122253},{"id":"https://openalex.org/C97541855","wikidata":"https://www.wikidata.org/wiki/Q830687","display_name":"Reinforcement learning","level":2,"score":0.6781256794929504},{"id":"https://openalex.org/C48145219","wikidata":"https://www.wikidata.org/wiki/Q1335365","display_name":"Security token","level":2,"score":0.6431384086608887},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.5518327355384827},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.48307040333747864},{"id":"https://openalex.org/C134066672","wikidata":"https://www.wikidata.org/wiki/Q1424639","display_name":"Payload (computing)","level":3,"score":0.44433942437171936},{"id":"https://openalex.org/C167966045","wikidata":"https://www.wikidata.org/wiki/Q5532625","display_name":"Generative model","level":3,"score":0.42076346278190613},{"id":"https://openalex.org/C39890363","wikidata":"https://www.wikidata.org/wiki/Q36108","display_name":"Generative grammar","level":2,"score":0.2161538302898407},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.18703654408454895},{"id":"https://openalex.org/C158379750","wikidata":"https://www.wikidata.org/wiki/Q214111","display_name":"Network packet","level":2,"score":0.0}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1109/tdsc.2023.3252523","is_oa":false,"landing_page_url":"https://doi.org/10.1109/tdsc.2023.3252523","pdf_url":null,"source":{"id":"https://openalex.org/S133795288","display_name":"IEEE Transactions on Dependable and Secure Computing","issn_l":"1545-5971","issn":["1545-5971","1941-0018","2160-9209"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310320439","host_organization_name":"IEEE Computer Society","host_organization_lineage":["https://openalex.org/P4310320439","https://openalex.org/P4310319808"],"host_organization_lineage_names":["IEEE Computer Society","Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Transactions on Dependable and Secure Computing","raw_type":"journal-article"}],"best_oa_location":null,"sustainable_development_goals":[{"display_name":"Peace, Justice and strong institutions","score":0.6499999761581421,"id":"https://metadata.un.org/sdg/16"}],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":32,"referenced_works":["https://openalex.org/W1962083226","https://openalex.org/W2064924033","https://openalex.org/W2107230831","https://openalex.org/W2119717200","https://openalex.org/W2150566873","https://openalex.org/W2528809805","https://openalex.org/W2766447205","https://openalex.org/W2810065972","https://openalex.org/W2896457183","https://openalex.org/W2939467494","https://openalex.org/W2946129952","https://openalex.org/W2952298682","https://openalex.org/W2954308093","https://openalex.org/W2962762898","https://openalex.org/W2963325985","https://openalex.org/W2996044589","https://openalex.org/W2998170209","https://openalex.org/W2999097465","https://openalex.org/W3037718519","https://openalex.org/W3042471545","https://openalex.org/W3092450653","https://openalex.org/W3126389064","https://openalex.org/W3180874179","https://openalex.org/W4214813133","https://openalex.org/W6631190155","https://openalex.org/W6638018090","https://openalex.org/W6734423058","https://openalex.org/W6739901393","https://openalex.org/W6741002519","https://openalex.org/W6767858076","https://openalex.org/W6778883912","https://openalex.org/W6782465632"],"related_works":["https://openalex.org/W1535080110","https://openalex.org/W306312984","https://openalex.org/W857189463","https://openalex.org/W2979675132","https://openalex.org/W2790520092","https://openalex.org/W4306309337","https://openalex.org/W20648474","https://openalex.org/W2109516765","https://openalex.org/W4288094128","https://openalex.org/W4313563004"],"abstract_inverted_index":{"Web":[0],"Application":[1],"Firewalls":[2],"(WAFs)":[3],"are":[4],"widely":[5],"deployed":[6],"to":[7,20,24,80,100,124,171,190],"protect":[8],"key":[9],"web":[10],"applications":[11],"against":[12,148],"multiple":[13],"security":[14],"threats,":[15],"so":[16],"it":[17,142],"is":[18,35],"important":[19],"test":[21,81],"WAFs":[22,82,147],"regularly":[23],"prevent":[25],"attackers":[26],"from":[27,56],"bypassing":[28,177,186],"them":[29],"easily.":[30],"Machine-learning-based":[31],"black-box":[32],"WAF":[33],"testing":[34],"gaining":[36],"more":[37,112,176],"attention,":[38],"though":[39],"existing":[40],"learning-based":[41],"approaches":[42],"have":[43,103],"strict":[44],"requirements":[45],"on":[46,107,143,174,193],"the":[47,57,104,126,133],"source":[48],"and":[49,54,64,74,110,116,121,131,140,167],"scale":[50],"of":[51,128,151],"payload":[52,108],"data":[53,109],"suffer":[55],"local":[58,134],"optimum":[59,135],"problem,":[60],"limiting":[61],"their":[62],"effectiveness":[63,127],"practical":[65],"application.":[66],"We":[67,137],"propose":[68],"GPTFuzzer,":[69],"a":[70,91],"<italic":[71,75,163],"xmlns:mml=\"http://www.w3.org/1998/Math/MathML\"":[72,76,164],"xmlns:xlink=\"http://www.w3.org/1999/xlink\">practical</i>":[73],"xmlns:xlink=\"http://www.w3.org/1999/xlink\">effective</i>":[77],"generation-based":[78],"approach":[79,130],"by":[83],"generating":[84],"attack":[85],"payloads":[86,178,187],"token-by-token.":[87],"Specifically,":[88],"we":[89,117],"fine-tune":[90],"Generative":[92],"Pre-trained":[93],"Transformer":[94],"language":[95],"model":[96],"with":[97],"reinforcement":[98],"learning":[99],"make":[101],"GPTFuzzer":[102,139,158],"least":[105],"restrictions":[106],"thus":[111],"applicable":[113],"in":[114],"practice,":[115],"use":[118],"reward":[119],"modeling":[120],"KL-divergence":[122],"penalty":[123],"improve":[125],"our":[129],"mitigate":[132],"issue.":[136],"implement":[138],"evaluate":[141],"two":[144],"well-known":[145],"open-source":[146],"three":[149],"kinds":[150],"common":[152],"attacks.":[153],"Experimental":[154],"results":[155],"show":[156],"that":[157],"significantly":[159],"outperforms":[160],"state-of-the-art":[161],"approaches,":[162],"xmlns:xlink=\"http://www.w3.org/1999/xlink\">i.e.</i>":[165],"ML-Driven":[166],"RAT,":[168],"finding":[169,183],"up":[170,189],"7.8\u00d7":[172],"(3.2\u00d7":[173],"average)":[175,194],"within":[179],"1,250,000":[180],"requests,":[181],"or":[182],"out":[184],"all":[185],"using":[188],"8.1\u00d7":[191],"(3.3\u00d7":[192],"fewer":[195],"requests.":[196]},"counts_by_year":[{"year":2026,"cited_by_count":5},{"year":2025,"cited_by_count":15},{"year":2024,"cited_by_count":8},{"year":2023,"cited_by_count":3}],"updated_date":"2026-03-27T05:58:40.876381","created_date":"2025-10-10T00:00:00"}