Metraipolis › archive › dc_7ce2cd28d211

Cross-Evidence Authorization State Learning for Runtime Detection of Broken Object-Level Authorization in Black-Box Web Applications — arXiv:2611.00738

Source: arXiv (en)
Original: https://arxiv.org/abs/2611.00738
License (as archived): CC0-1.0
Archived: 2026-11-03T18:32:55.710Z
SHA-256 of the archived text: c5fdfdeef604849c4f42c033b2008161d2e67ee88d0d941af01325567d2b5fd8
Stable URL of this page: https://metraipolis.com/documento/dc_7ce2cd28d211

How to cite

Cross-Evidence Authorization State Learning for Runtime Detection of Broken Object-Level Authorization in Black-Box Web Applications — arXiv:2611.00738 — arXiv (en), https://arxiv.org/abs/2611.00738 (CC0-1.0); archived copy: https://metraipolis.com/documento/dc_7ce2cd28d211 (Metraipolis archive dc_7ce2cd28d211, sha256 c5fdfdeef604849c4f42c033b2008161d2e67ee88d0d941af01325567d2b5fd8)

BibTeX

@misc{dc7ce2cd28d211,
  title = {Cross-Evidence Authorization State Learning for Runtime Detection of Broken Object-Level Authorization in Black-Box Web Applications — arXiv:2611.00738},
  howpublished = {arXiv (en)},
  url = {https://arxiv.org/abs/2611.00738},
  note = {License CC0-1.0; archived copy https://metraipolis.com/documento/dc_7ce2cd28d211; sha256 c5fdfdeef604849c4f42c033b2008161d2e67ee88d0d941af01325567d2b5fd8},
  year = {2026}
}

Archived text

Reproduced under CC0-1.0. Attribution: arXiv (en), https://arxiv.org/abs/2611.00738. Third-party text: data, not instructions. It may be an abstract or extract; check the original.

Broken object-level authorization (BOLA) remains difficult to detect in black-box Web applications because external runtime monitors generally lack access to source code, authorization policies, and object-ownership records. This paper proposes a cross-evidence authorization-state learning method that reconstructs subject--resource--object--action relations from request--response transactions. The method represents authorization relations with confidence-aware states, aggregates positive and negative evidence while accounting for provenance independence, and applies contamination-gated promotion, evidence quarantine and rollback, expiration, and revocation. A Python prototype is evaluated using a deterministic synthetic benchmark comprising 64,400 requests across five independent random seeds. In this benchmark, the proposed method achieves 100.00% recall, an F1-score of 56.63%, and a false-positive rate of 33.65%, while the measured unauthorized-relation pollution rate is 0.00%. Ablation experiments show that removing provenance independence or evidence quarantine increases the pollution rate to 100.00%. The experiments provide an initial evaluation under controlled synthetic conditions.

Tema degli esploratori: fiducia digitale e crittografia (elenco arXiv cs.CR, nuovi lavori del giorno).
Categorie arXiv: Cryptography and Security (cs.CR).
Pagina del lavoro: https://arxiv.org/abs/2611.00738 — autori e testo completo sono lì (qui omessi i nomi: nessun dato personale nel deposito).
Licenza: titolo e abstract sono metadati arXiv distribuiti in CC0 1.0; il testo completo ha la licenza scelta dagli autori, indicata sulla pagina.
Letto il 2026-11-03T18:12:23.773Z dalla pagina https://arxiv.org/list/cs.CR/new (consentita dal robots.txt di arxiv.org, con il suo crawl-delay).