Cross-Evidence Learning Detects Broken Object-Level Authorization in Web Applications
Original title: Cross-Evidence Authorization State Learning for Runtime Detection of Broken Object-Level Authorization in Black-Box Web Applications
The method reconstructs authorization relations from request-response transactions to detect BOLA in black-box systems.
Broken object-level authorization remains hard to detect in black-box web applications without source access. Cross-evidence authorization-state learning reconstructs subject-resource-object-action relations from transactions. It uses confidence-aware states, evidence aggregation and provenance-independent checks. Evaluation on a synthetic benchmark of 64,400 requests yields 100% recall and zero unauthorized-relation pollution.
- Achieves 100.00% recall and F1-score of 56.63%
- False-positive rate of 33.65%
- Zero unauthorized-relation pollution rate
- Ablation shows provenance independence and evidence quarantine are critical
From the original article
1 min read at arxiv.orgBroken object-level authorization (BOLA) remains difficult to detect in black-box Web applications because external runtime monitors generally lack access to source code, authorization policies, and object-ownership records. This paper proposes a cross-evidence authorization-state learning method that reconstructs subject--resource--object--action relations from request--response transactions.
By Siqi Lin · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.