Techniques for discovering broken access control vulnerabilities constructed upon abnormal behaviours

With the rise of mobile internet, cloud computing and big data, web applications are vital in many industries. Ensuring data security in web apps is crucial. Broken access control, a prevalent vulnerability arising from discrepancies between intended and actual permission checks, enables unauthorised data access, posing a severe threat. This paper analyses the causes and types of broken access control vulnerabilities. We propose a novel vulnerability mining approach leveraging abnormal behaviour. The method identifies sensitive behaviours indicative of vertical and horizontal vulnerabilities within normal user-server interactions and constructs corresponding abnormal behaviours for detection. To validate the efficacy of this approach, a comprehensive and rigorous experimentation process was carried out using a tailored web application system. The experimental results demonstrate the potential of this method for effectively identifying broken access control vulnerabilities within web applications, all without the need for accessing the source code itself, significantly enhancing detection efficiency.