A Non-Intrusive Traffic Analysis Framework for Authorization Risk Detection and Coordinated Response in Web Applications

2026-07-18

AI Summary

This work addresses the challenge of detecting session-based authorization violations in real time without modifying application code—a task hindered by the reliance on business semantics and the absence of explicit protocol-level indicators. To overcome this, the authors propose a non-intrusive runtime framework that analyzes network traffic to correlate request–response transactions and extract contextual elements such as access subjects, business endpoints, and object identifiers. These features inform multiple interpretable risk components, which are then fused via a high-risk-priority constrained weighting mechanism to support tiered decisions—permitting, alerting, or blocking suspicious activities. Empirical evaluation demonstrates that the approach achieves 99.90% accuracy and F1 score on a test set of 2,000 samples, with an average decision latency of only 0.077 ms.

Abstract

Authorization violations under valid Web sessions are difficult to identify and handle in real time from traffic because they depend strongly on business semantics and exhibit few distinctive protocol-level features. This paper proposes a non-intrusive traffic analysis framework for authorization risk detection and coordinated response. Request-response transactions are correlated to extract the access subject, business endpoint, object identifier, authentication state, and behavioral sequence. Object-access evidence, identity consistency, behavioral anomalies, authentication context, network environment, and endpoint-operation risk are mapped to interpretable risk components. Weighted fusion and high-risk priority constraints produce graded decisions that drive allow, alert, block, and external policy actions. The risk components are instantiated using deterministic and interpretable rules to evaluate multi-source evidence organization, risk fusion, and the coordinated-response loop at the framework level. In a controlled local testbed containing 2,000 balanced labeled samples, the framework classified 998 of 1,000 authorization-risk events as risky and produced no false positives among 1,000 normal accesses, achieving 99.90% accuracy, 100.00% precision, 99.80% recall, and a 99.90% F1 score. Removing runtime object evidence reduced the F1 score to 81.31%, while removing the high-risk priority constraint reduced it to 73.90%. In a prototype feasibility test with 100 concurrent requests and 1,000 total requests, mean risk-decision computation latency was 0.077 ms and P99 latency was 0.137 ms. The results demonstrate the feasibility of organizing heterogeneous runtime evidence and establishing an executable authorization-risk decision and coordinated-response loop without modifying application code, but do not establish general applicability in production environments.

Problem

• authorization violation
• web applications
• traffic analysis
• risk detection
• non-intrusive

Innovation

• non-intrusive traffic analysis
• authorization risk detection
• interpretable risk components
• coordinated response
• runtime evidence fusion