BFTDETECTOR: Automatic Detection of Business Flow Tampering for Digital Content Service
BFTDETECTOR: Automatic Detection of Business Flow Tampering for Digital Content Service
复制标题
DOI：
10.1109/icse48619.2023.00048
复制
发表时间：
2023-05
期刊：
影响因子：
--
通讯作者：
I. L. Kim;Weihang Wang;Yonghwi Kwon;X. Zhang
中科院分区：
文献类型：
--
作者：
I. L. Kim;Weihang Wang;Yonghwi Kwon;X. Zhang
数字内容服务为用户提供广泛的内容，如新闻、文章或电影，同时通过各种商业模式和促销方法将他们的内容货币化。不幸的是，恶意用户可以绕过设计不佳或不受保护的业务逻辑，这称为业务流篡改。此类缺陷可能会严重损害数字内容服务提供商的业务。本文提出了一种自动发现业务流篡改漏洞的方法。我们的技术自动运行Web服务来覆盖不同的业务流(例如，有订阅付费墙的新闻网站和没有订阅付费墙的新闻网站)来收集执行跟踪。我们对执行轨迹执行差异分析，以确定确定业务流如何开始不同的分歧点，然后我们测试这些分歧点是否可以被篡改。我们对352家现实世界的数字内容服务提供商进行了评估，发现了204个网站的315个缺陷，其中包括《时代》、《财富》和《福布斯》。我们的评估结果表明，我们的技术成功地识别了这些缺陷，漏检率和假阴性率分别为0.49%和1.44%。
Digital content services provide users with a wide range of content, such as news, articles, or movies, while monetizing their content through various business models and promotional methods. Unfortunately, poorly designed or unpro-tected business logic can be circumvented by malicious users, which is known as business flow tampering. Such flaws can severely harm the businesses of digital content service providers. In this paper, we propose an automated approach that discov-ers business flow tampering flaws. Our technique automatically runs a web service to cover different business flows (e.g., a news website with vs. without a subscription paywall) to collect execution traces. We perform differential analysis on the execution traces to identify divergence points that determine how the business flow begins to differ, and then we test to see if the divergence points can be tampered with. We assess our approach against 352 real-world digital content service providers and discover 315 flaws from 204 websites, including TIME, Fortune, and Forbes. Our evaluation result shows that our technique successfully identifies these flaws with low false-positive and false-negative rates of 0.49% and 1.44%, respectively.