{"id":"https://openalex.org/W7083299822","doi":"https://doi.org/10.1109/tifs.2025.3614424","title":"Facilitating Access Control Vulnerability Detection in Modern Java Web Applications With Accurate Permission Check Identification","display_name":"Facilitating Access Control Vulnerability Detection in Modern Java Web Applications With Accurate Permission Check Identification","publication_year":2025,"publication_date":"2025-01-01","ids":{"openalex":"https://openalex.org/W7083299822","doi":"https://doi.org/10.1109/tifs.2025.3614424"},"language":"en","primary_location":{"id":"doi:10.1109/tifs.2025.3614424","is_oa":false,"landing_page_url":"https://doi.org/10.1109/tifs.2025.3614424","pdf_url":null,"source":{"id":"https://openalex.org/S61310614","display_name":"IEEE Transactions on Information Forensics and Security","issn_l":"1556-6013","issn":["1556-6013","1556-6021"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Transactions on Information Forensics and Security","raw_type":"journal-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":null,"display_name":"Youkun Shi","orcid":"https://orcid.org/0009-0004-0763-4732"},"institutions":[{"id":"https://openalex.org/I24943067","display_name":"Fudan University","ror":"https://ror.org/013q1eq08","country_code":"CN","type":"education","lineage":["https://openalex.org/I24943067"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Youkun Shi","raw_affiliation_strings":["School of Computer Science and Technology, Fudan University, Shanghai, China"],"raw_orcid":"https://orcid.org/0009-0004-0763-4732","affiliations":[{"raw_affiliation_string":"School of Computer Science and Technology, Fudan University, Shanghai, China","institution_ids":["https://openalex.org/I24943067"]}]},{"author_position":"middle","author":{"id":null,"display_name":"Fengyu Liu","orcid":"https://orcid.org/0009-0009-4680-6513"},"institutions":[{"id":"https://openalex.org/I24943067","display_name":"Fudan University","ror":"https://ror.org/013q1eq08","country_code":"CN","type":"education","lineage":["https://openalex.org/I24943067"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Fengyu Liu","raw_affiliation_strings":["School of Computer Science and Technology, Fudan University, Shanghai, China"],"raw_orcid":"https://orcid.org/0009-0009-4680-6513","affiliations":[{"raw_affiliation_string":"School of Computer Science and Technology, Fudan University, Shanghai, China","institution_ids":["https://openalex.org/I24943067"]}]},{"author_position":"middle","author":{"id":null,"display_name":"Guangliang Yang","orcid":"https://orcid.org/0000-0001-7066-0109"},"institutions":[{"id":"https://openalex.org/I24943067","display_name":"Fudan University","ror":"https://ror.org/013q1eq08","country_code":"CN","type":"education","lineage":["https://openalex.org/I24943067"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Guangliang Yang","raw_affiliation_strings":["School of Computer Science and Technology, Fudan University, Shanghai, China"],"raw_orcid":"https://orcid.org/0000-0001-7066-0109","affiliations":[{"raw_affiliation_string":"School of Computer Science and Technology, Fudan University, Shanghai, China","institution_ids":["https://openalex.org/I24943067"]}]},{"author_position":"middle","author":{"id":null,"display_name":"Yuan Zhang","orcid":"https://orcid.org/0000-0003-0726-9996"},"institutions":[{"id":"https://openalex.org/I24943067","display_name":"Fudan University","ror":"https://ror.org/013q1eq08","country_code":"CN","type":"education","lineage":["https://openalex.org/I24943067"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Yuan Zhang","raw_affiliation_strings":["School of Computer Science and Technology, Fudan University, Shanghai, China"],"raw_orcid":"https://orcid.org/0000-0003-0726-9996","affiliations":[{"raw_affiliation_string":"School of Computer Science and Technology, Fudan University, Shanghai, China","institution_ids":["https://openalex.org/I24943067"]}]},{"author_position":"middle","author":{"id":null,"display_name":"Yinzhi Cao","orcid":"https://orcid.org/0000-0002-9618-4830"},"institutions":[{"id":"https://openalex.org/I145311948","display_name":"Johns Hopkins University","ror":"https://ror.org/00za53h95","country_code":"US","type":"education","lineage":["https://openalex.org/I145311948"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Yinzhi Cao","raw_affiliation_strings":["Department of Computer Science, Johns Hopkins University, Baltimore, MD, USA"],"raw_orcid":"https://orcid.org/0000-0002-9618-4830","affiliations":[{"raw_affiliation_string":"Department of Computer Science, Johns Hopkins University, Baltimore, MD, USA","institution_ids":["https://openalex.org/I145311948"]}]},{"author_position":"middle","author":{"id":null,"display_name":"Enhao Li","orcid":"https://orcid.org/0009-0006-8141-7319"},"institutions":[{"id":"https://openalex.org/I24943067","display_name":"Fudan University","ror":"https://ror.org/013q1eq08","country_code":"CN","type":"education","lineage":["https://openalex.org/I24943067"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Enhao Li","raw_affiliation_strings":["School of Computer Science and Technology, Fudan University, Shanghai, China"],"raw_orcid":"https://orcid.org/0009-0006-8141-7319","affiliations":[{"raw_affiliation_string":"School of Computer Science and Technology, Fudan University, Shanghai, China","institution_ids":["https://openalex.org/I24943067"]}]},{"author_position":"middle","author":{"id":null,"display_name":"Xin Tan","orcid":"https://orcid.org/0009-0009-9018-0386"},"institutions":[{"id":"https://openalex.org/I24943067","display_name":"Fudan University","ror":"https://ror.org/013q1eq08","country_code":"CN","type":"education","lineage":["https://openalex.org/I24943067"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Xin Tan","raw_affiliation_strings":["School of Computer Science and Technology, Fudan University, Shanghai, China"],"raw_orcid":"https://orcid.org/0009-0009-9018-0386","affiliations":[{"raw_affiliation_string":"School of Computer Science and Technology, Fudan University, Shanghai, China","institution_ids":["https://openalex.org/I24943067"]}]},{"author_position":"middle","author":{"id":null,"display_name":"Xiapu Luo","orcid":"https://orcid.org/0000-0002-9082-3208"},"institutions":[{"id":"https://openalex.org/I14243506","display_name":"Hong Kong Polytechnic University","ror":"https://ror.org/0030zas98","country_code":"HK","type":"education","lineage":["https://openalex.org/I14243506"]}],"countries":["HK"],"is_corresponding":false,"raw_author_name":"Xiapu Luo","raw_affiliation_strings":["Department of Computing, The Hong Kong Polytechnic University, Hong Kong, China"],"raw_orcid":"https://orcid.org/0000-0002-9082-3208","affiliations":[{"raw_affiliation_string":"Department of Computing, The Hong Kong Polytechnic University, Hong Kong, China","institution_ids":["https://openalex.org/I14243506"]}]},{"author_position":"middle","author":{"id":null,"display_name":"Min Yang","orcid":"https://orcid.org/0000-0001-9714-5545"},"institutions":[{"id":"https://openalex.org/I24943067","display_name":"Fudan University","ror":"https://ror.org/013q1eq08","country_code":"CN","type":"education","lineage":["https://openalex.org/I24943067"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Min Yang","raw_affiliation_strings":["School of Computer Science and Technology, Fudan University, Shanghai, China"],"raw_orcid":"https://orcid.org/0000-0001-9714-5545","affiliations":[{"raw_affiliation_string":"School of Computer Science and Technology, Fudan University, Shanghai, China","institution_ids":["https://openalex.org/I24943067"]}]},{"author_position":"last","author":{"id":null,"display_name":"Siyi Chen","orcid":"https://orcid.org/0009-0005-8448-689X"},"institutions":[{"id":"https://openalex.org/I45928872","display_name":"Alibaba Group (China)","ror":"https://ror.org/00k642b80","country_code":"CN","type":"company","lineage":["https://openalex.org/I45928872"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Siyi Chen","raw_affiliation_strings":["Alibaba Group, Hangzhou, China"],"raw_orcid":"https://orcid.org/0009-0005-8448-689X","affiliations":[{"raw_affiliation_string":"Alibaba Group, Hangzhou, China","institution_ids":["https://openalex.org/I45928872"]}]}],"institutions":[],"countries_distinct_count":3,"institutions_distinct_count":4,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":1.3042,"has_fulltext":false,"cited_by_count":1,"citation_normalized_percentile":{"value":0.8858646,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":{"min":94,"max":97},"biblio":{"volume":"20","issue":null,"first_page":"10683","last_page":"10698"},"is_retracted":false,"is_paratext":false,"is_xpac":true,"primary_topic":{"id":"https://openalex.org/T12157","display_name":"Geochemistry and Geologic Mapping","score":0.6571000218391418,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T12157","display_name":"Geochemistry and Geologic Mapping","score":0.6571000218391418,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T13067","display_name":"Geological Modeling and Analysis","score":0.02630000002682209,"subfield":{"id":"https://openalex.org/subfields/1906","display_name":"Geochemistry and Petrology"},"field":{"id":"https://openalex.org/fields/19","display_name":"Earth and Planetary Sciences"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T14311","display_name":"Electrical and Electromagnetic Research","score":0.017999999225139618,"subfield":{"id":"https://openalex.org/subfields/3107","display_name":"Atomic and Molecular Physics, and Optics"},"field":{"id":"https://openalex.org/fields/31","display_name":"Physics and Astronomy"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/java","display_name":"Java","score":0.7700999975204468},{"id":"https://openalex.org/keywords/java-api-for-xml-based-rpc","display_name":"Java API for XML-based RPC","score":0.632099986076355},{"id":"https://openalex.org/keywords/permission","display_name":"Permission","score":0.6017000079154968},{"id":"https://openalex.org/keywords/web-application","display_name":"Web application","score":0.5552999973297119},{"id":"https://openalex.org/keywords/secure-coding","display_name":"Secure coding","score":0.5274999737739563},{"id":"https://openalex.org/keywords/web-application-security","display_name":"Web application security","score":0.5040000081062317},{"id":"https://openalex.org/keywords/cross-site-scripting","display_name":"Cross-site scripting","score":0.44920000433921814},{"id":"https://openalex.org/keywords/access-control","display_name":"Access control","score":0.44339999556541443},{"id":"https://openalex.org/keywords/java-applet","display_name":"Java applet","score":0.4097999930381775}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.8870999813079834},{"id":"https://openalex.org/C548217200","wikidata":"https://www.wikidata.org/wiki/Q251","display_name":"Java","level":2,"score":0.7700999975204468},{"id":"https://openalex.org/C32235180","wikidata":"https://www.wikidata.org/wiki/Q921902","display_name":"Java API for XML-based RPC","level":5,"score":0.632099986076355},{"id":"https://openalex.org/C2779089604","wikidata":"https://www.wikidata.org/wiki/Q7169333","display_name":"Permission","level":2,"score":0.6017000079154968},{"id":"https://openalex.org/C118643609","wikidata":"https://www.wikidata.org/wiki/Q189210","display_name":"Web application","level":2,"score":0.5552999973297119},{"id":"https://openalex.org/C22680326","wikidata":"https://www.wikidata.org/wiki/Q7444867","display_name":"Secure coding","level":5,"score":0.5274999737739563},{"id":"https://openalex.org/C59241245","wikidata":"https://www.wikidata.org/wiki/Q4781497","display_name":"Web application security","level":4,"score":0.5040000081062317},{"id":"https://openalex.org/C136764020","wikidata":"https://www.wikidata.org/wiki/Q466","display_name":"World Wide Web","level":1,"score":0.451200008392334},{"id":"https://openalex.org/C39569185","wikidata":"https://www.wikidata.org/wiki/Q371199","display_name":"Cross-site scripting","level":5,"score":0.44920000433921814},{"id":"https://openalex.org/C527821871","wikidata":"https://www.wikidata.org/wiki/Q228502","display_name":"Access control","level":2,"score":0.44339999556541443},{"id":"https://openalex.org/C15524039","wikidata":"https://www.wikidata.org/wiki/Q865817","display_name":"Java applet","level":3,"score":0.4097999930381775},{"id":"https://openalex.org/C132106392","wikidata":"https://www.wikidata.org/wiki/Q1373903","display_name":"Real time Java","level":3,"score":0.3970000147819519},{"id":"https://openalex.org/C35578498","wikidata":"https://www.wikidata.org/wiki/Q193424","display_name":"Web service","level":2,"score":0.39649999141693115},{"id":"https://openalex.org/C116834253","wikidata":"https://www.wikidata.org/wiki/Q2039217","display_name":"Identification (biology)","level":2,"score":0.38670000433921814},{"id":"https://openalex.org/C130436687","wikidata":"https://www.wikidata.org/wiki/Q7978591","display_name":"Web modeling","level":3,"score":0.38089999556541443},{"id":"https://openalex.org/C154504017","wikidata":"https://www.wikidata.org/wiki/Q853614","display_name":"Identifier","level":2,"score":0.3774999976158142},{"id":"https://openalex.org/C110875604","wikidata":"https://www.wikidata.org/wiki/Q75","display_name":"The Internet","level":2,"score":0.3774000108242035},{"id":"https://openalex.org/C21959979","wikidata":"https://www.wikidata.org/wiki/Q36774","display_name":"Web page","level":2,"score":0.3698999881744385},{"id":"https://openalex.org/C11392498","wikidata":"https://www.wikidata.org/wiki/Q11288","display_name":"Web server","level":3,"score":0.34529998898506165},{"id":"https://openalex.org/C168702491","wikidata":"https://www.wikidata.org/wiki/Q567345","display_name":"Java annotation","level":4,"score":0.32749998569488525},{"id":"https://openalex.org/C95713431","wikidata":"https://www.wikidata.org/wiki/Q631425","display_name":"Vulnerability (computing)","level":2,"score":0.323199987411499},{"id":"https://openalex.org/C77088390","wikidata":"https://www.wikidata.org/wiki/Q8513","display_name":"Database","level":1,"score":0.32280001044273376},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.2971000075340271},{"id":"https://openalex.org/C148417208","wikidata":"https://www.wikidata.org/wiki/Q4825882","display_name":"Authentication (law)","level":2,"score":0.2897999882698059},{"id":"https://openalex.org/C79373723","wikidata":"https://www.wikidata.org/wiki/Q386275","display_name":"Web development","level":3,"score":0.2705000042915344},{"id":"https://openalex.org/C164554305","wikidata":"https://www.wikidata.org/wiki/Q71550","display_name":"Application server","level":2,"score":0.2624000012874603},{"id":"https://openalex.org/C127705205","wikidata":"https://www.wikidata.org/wiki/Q5748245","display_name":"Heuristics","level":2,"score":0.2590999901294708},{"id":"https://openalex.org/C174954855","wikidata":"https://www.wikidata.org/wiki/Q7623626","display_name":"strictfp","level":4,"score":0.2583000063896179},{"id":"https://openalex.org/C2780385302","wikidata":"https://www.wikidata.org/wiki/Q367158","display_name":"Protocol (science)","level":3,"score":0.2565999925136566}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1109/tifs.2025.3614424","is_oa":false,"landing_page_url":"https://doi.org/10.1109/tifs.2025.3614424","pdf_url":null,"source":{"id":"https://openalex.org/S61310614","display_name":"IEEE Transactions on Information Forensics and Security","issn_l":"1556-6013","issn":["1556-6013","1556-6021"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Transactions on Information Forensics and Security","raw_type":"journal-article"}],"best_oa_location":null,"sustainable_development_goals":[],"awards":[{"id":"https://openalex.org/G348829379","display_name":null,"funder_award_id":"U2436207","funder_id":"https://openalex.org/F4320321001","funder_display_name":"National Natural Science Foundation of China"},{"id":"https://openalex.org/G3710417583","display_name":null,"funder_award_id":"U2436207, 62172105, 62202106","funder_id":"https://openalex.org/F4320321001","funder_display_name":"National Natural Science Foundation of China"},{"id":"https://openalex.org/G5066171950","display_name":null,"funder_award_id":"62202106","funder_id":"https://openalex.org/F4320321001","funder_display_name":"National Natural Science Foundation of China"},{"id":"https://openalex.org/G8928773622","display_name":null,"funder_award_id":"62172105","funder_id":"https://openalex.org/F4320321001","funder_display_name":"National Natural Science Foundation of China"}],"funders":[{"id":"https://openalex.org/F4320321001","display_name":"National Natural Science Foundation of China","ror":"https://ror.org/01h0zpd94"}],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":33,"referenced_works":["https://openalex.org/W1992114977","https://openalex.org/W2038173986","https://openalex.org/W2070689669","https://openalex.org/W2079452443","https://openalex.org/W2080781552","https://openalex.org/W2086042629","https://openalex.org/W2086631206","https://openalex.org/W2151152024","https://openalex.org/W2363172845","https://openalex.org/W2534610146","https://openalex.org/W2573570214","https://openalex.org/W2732351623","https://openalex.org/W2752602409","https://openalex.org/W2793043914","https://openalex.org/W2967904600","https://openalex.org/W2969658140","https://openalex.org/W3012643811","https://openalex.org/W3095708133","https://openalex.org/W3136748915","https://openalex.org/W3156952258","https://openalex.org/W3207703975","https://openalex.org/W4285493464","https://openalex.org/W4308391493","https://openalex.org/W4308410314","https://openalex.org/W4313563531","https://openalex.org/W4324007098","https://openalex.org/W4384948751","https://openalex.org/W4388858891","https://openalex.org/W4402263994","https://openalex.org/W4405170929","https://openalex.org/W4406110427","https://openalex.org/W4411337231","https://openalex.org/W4411337893"],"related_works":[],"abstract_inverted_index":{"Access-control":[0],"vulnerabilities":[1,26,69],"have":[2],"emerged":[3],"as":[4],"a":[5,16,80,145,151,156],"significant":[6],"concern":[7],"in":[8,27,37,50,70,123,160],"recent":[9],"years,":[10],"posing":[11],"considerable":[12],"security":[13],"risks":[14],"to":[15,59,66,91],"wide":[17],"range":[18],"of":[19,24,148,153,158],"critical":[20],"systems.":[21],"The":[22],"detection":[23],"access-control":[25,41,102],"Java":[28,52,72,98,128],"web":[29,53,56,73,99,129],"applications":[30,54],"poses":[31],"unique":[32],"challenges,":[33],"because":[34],"heuristics":[35],"used":[36],"the":[38],"past,":[39],"e.g.,":[40],"specifications":[42],"or":[43],"format-specific":[44],"runtime":[45],"logs,":[46],"may":[47],"not":[48],"exist":[49],"modern":[51,71],"using":[55],"frameworks.":[57],"Therefore,":[58],"date,":[60],"there":[61],"is":[62],"no":[63],"effective":[64],"approach":[65],"detecting":[67],"such":[68],"applications.":[74,130],"In":[75],"this":[76],"paper,":[77],"we":[78],"introduce":[79],"novel":[81],"approach,":[82],"called":[83],"PCFinder,":[84],"which":[85],"leverages":[86],"multi-level":[87],"semantics-":[88],"and":[89,140,155],"context-analysis":[90],"conduct":[92],"accurate":[93],"permission-check":[94],"identifications":[95],"against":[96],"real-world":[97,127],"infrastructures":[100],"for":[101],"vulnerability":[103],"detection.":[104],"PCFinder":[105,134,143],"successfully":[106],"discovered":[107],"58":[108],"high-risk":[109],"broken":[110],"access":[111],"control":[112],"vulnerabilities,":[113],"with":[114],"30":[115],"having":[116],"been":[117],"assigned":[118],"CVE":[119],"identifiers":[120],"thus":[121],"far,":[122],"analyzing":[124],"50":[125],"popular,":[126],"We":[131],"also":[132],"evaluate":[133],"on":[135],"manually":[136],"constructed":[137],"ground-truth":[138],"data":[139],"show":[141],"that":[142],"achieved":[144],"high":[146],"level":[147],"accuracy,":[149],"i.e.,":[150],"precision":[152],"94.12%":[154],"recall":[157],"96.97%":[159],"identifying":[161],"permission":[162],"checks.":[163]},"counts_by_year":[{"year":2026,"cited_by_count":1}],"updated_date":"2026-07-15T18:14:33.161393","created_date":"2025-10-10T00:00:00"}