Detecting Business-Logic Vulnerabilities in REST APIs Based on Knowledge Distillation

Business-logic vulnerabilities (BLVs) exploit flaws in an application's intended workflow-quota checks, state transitions, privilege boundaries-that lie far above the syntactic layer targeted by conventional scanners. Automatic BLV detection is challenging because the attack surface is governed by domain-specific rules, multi-step interactions, and scarce ground-truth labels. We present LogicGPT, a knowledge-distillation framework that compresses the deep reasoning capability of a 32-billion- parameter instruction-tuned transformer (teacher) into an INT8-quantised, 8-billion-parameter student optimised for real-time defence. The teacher consumes event sentences-execution traces, REST-API request/response pairs, and resource-lifecycle metadata-and, guided by a BLV taxonomy and self-supervised contrastive objectives, emits soft labels and high-salience attention maps that explain whether and why a transaction sequence violates business invariants. Multi-objective distillation (response, feature, and relational KD) enables the student to preserve ≈ 85% of the teacher's F1 while running eight times faster (≈ 100 transactions s') on a single Ascend 910B3 GPU and remaining deployable on edge-level TPUs. Extensive experiments on twelve production REST systems and a two-million-event billing corpus from State Grid show that LogicGPT attains 92% recall-a 17-point improvement over rule-based baselines-with only 4.2% false positives. Each alert includes an interpretable causal chain that ties anomalous states to concrete workflow violations. Ablation studies confirm that knowledge distillation, rather than data volume alone, contributes ≈ 70% of the performance gains. These results demonstrate that a teacher-student architecture can deliver deployable, explainable, and high-throughput protection against business-logic abuse, closing a critical gap in enterprise API security monitoring.