The Mayhem Cyber Reasoning System

Mayhem is one of the first generation of autonomous computer security bots that finds and fixes vulnerabilities without any human intervention. Mayhem won the DARPA Cyber Grand Challenge (CGC) contest and $2,000,000 in August 2016 against six other finalists. The contest was the result of a two-year DARPA program, but the R&D necessary to compete stands on the shoulders of decades of basic academic and industry scientific research in program analysis, verification, and self-healing systems. The Mayhem system alone was developed over a decade of research in academia, which was spun out to a company called ForAllSecure. Mayhem is now being commercialized by ForAllSecure to autonomously check and protect the world’s software from exploitable bugs. In this article, we look back and give our story in creating Mayhem, and also look forward to a vision where autonomous security bots like Mayhem will radically improve the security of computer systems.