Enhancing API Security Testing against BOLA and Authentication Vulnerabilities through an LLM-Enhanced Framework
Enhancing API Security Testing against BOLA and Authentication Vulnerabilities through an LLM-Enhanced Framework
Emil Marian Pasca, Rudolf Erdei, Daniela Delinschi, Oliviu Matei
Abstract. Broken Object Level Authorization (BOLA) and authentication-related issues are consistently among the most critical vulnerabilities in modern APIs. This paper introduces an LLM-enhanced framework specifically designed to improve security testing against BOLA and authentication vulnerabilities. The framework augments traditional API testing pipelines with Large Language Models that generate context-aware test cases, identify suspicious authorization patterns and propose targeted attack scenarios based on the API specification and observed traffic. Experimental evaluations on representative APIs show that the proposed framework substantially increases the detection rate of BOLA and authentication flaws compared to baseline approaches, while keeping false positive rates manageable.
Keywords: API security; BOLA; authentication; large language models; vulnerability assessment
📋 Cite this publication
Emil Marian Pasca, Rudolf Erdei, Daniela Delinschi, Oliviu Matei, "Enhancing API Security Testing against BOLA and Authentication Vulnerabilities through an LLM-Enhanced Framework", Proc. 19th SOCO Int. Conf. on Soft Computing Models in Industrial and Environmental Applications, Springer, 2024, 2023.
Reference: Proc. 19th SOCO Int. Conf. on Soft Computing Models in Industrial and Environmental Applications, Springer, 2024.
Solving the clustered minimum routing tree problem using Prüfer-coding based hybrid genetic algorithms
Solving the clustered minimum routing tree problem using Prüfer-coding based hybrid genetic...
Augmenting API Security Testing with Automated LLM-Driven Test Generation
Augmenting API Security Testing with Automated LLM-Driven Test GenerationEmil Marian Pasca, Rudolf...
Data Quality Assessment Methodology
Data Quality Assessment MethodologyDaniela Delinschi, Rudolf Erdei, Emil Pasca, Oliviu Matei...
Privacy Assessment Methodology for Machine Learning Models and Data Sources
Privacy Assessment Methodology for Machine Learning Models and Data SourcesRudolf Erdei, Emil...
Evaluation of Feature Selection Methods in Estimation of Precipitation Based on Deep Learning Artificial Neural Networks
Precipitation is the most important element of the water cycle and an indispensable element of water resources management. This paper aims to model the monthly precipitation in 8 precipitation observation stations. The effects and role of different feature weights pre-processing methods (Weight by deviation, Weight by PCA, Weight by correlation, and Weight by Support Vector Machine) on artificial intelligence modeling were investigated.
A Comparison of different crossover operators in genetic algorithms for clusters shortest-path tree problem
The clustered shortest-path tree (CluSPT) problem is an extension of the classical shortest path problem, given a graph with the nodes partitioned into several mutually exclusive and collectively exhaustive clusters looks for a shortest-path spanning tree from a predefined source node to all the other nodes of the graph, with the property that every cluster should generate a connected subgraph.
A comprehensive survey on the generalized traveling salesman problem
The generalized traveling salesman problem (GTSP) is an extension of the classical traveling salesman
problem (TSP), and it is among the most researched combinatorial optimization problems due to its theoretical properties, complexity aspects, and real-life applications in various areas: location-routing problems, material flow design problem, distribution of medical supplies, urban waste collection management, airport selection and routing the courier airplanes, image retrieval and ranking, digital garment manufacturing, etc.
A hybrid based genetic algorithm for solving the clustered generalized traveling salesman problem
We study the clustered generalized traveling salesman problem (CGTSP), which is an extension of the generalized traveling salesman problem (GTSP), which in turn generalizes the well-known traveling salesman problem (TSP).
0 Comments