A Machine Learning Approach to Automate Greybox Testing

Cybersecurity threats evolve continually, posing ever-growing challenges to the confidentiality, integrity, and availability of digital infrastructures. This is critical for developers and testers who must balance, with time and budget constraints, secure development practices, especially for APIs that present critical threats in business logic, and access controls that standard security tools fail to detect. A gap remains automatically detecting this kind of vulnerability, leaving organizations exposed to information security risks. By using a machine learning engine trained on a real-world and private dataset, we were able to develop a greybox testing framework that automatically identifies access control and business logic vulnerabilities. We showed that our approach properly detects these types of weaknesses with an accuracy rate exceeding $\mathbf{9 0 \%}$, significantly reducing testing time and adapting to information security requirements.