The results demonstrate the feasibility of organizing heterogeneous runtime evidence and establishing an executable authorization-risk decision and coordinated-response loop without modifying application code, but do not establish general applicability in production environments.
Abstract
Authorization violations under valid Web sessions are difficult to identify and handle in real time from traffic because they depend strongly on business semantics and exhibit few distinctive protocol-level features. This paper proposes a non-intrusive traffic analysis framework for authorization risk detection and coordinated response. Request-response transactions are correlated to extract the access subject, business endpoint, object identifier, authentication state, and behavioral sequence. Object-access evidence, identity consistency, behavioral anomalies, authentication context, network environment, and endpoint-operation risk are mapped to interpretable risk components. Weighted fusion and high-risk priority constraints produce graded decisions that drive allow, alert, block, and external policy actions. The risk components are instantiated using deterministic and interpretable rules to evaluate multi-source evidence organization, risk fusion, and the coordinated-response loop at the framework level. In a controlled local testbed containing 2,000 balanced labeled samples, the framework classified 998 of 1,000 authorization-risk events as risky and produced no false positives among 1,000 normal accesses, achieving 99.90% accuracy, 100.00% precision, 99.80% recall, and a 99.90% F1 score. Removing runtime object evidence reduced the F1 score to 81.31%, while removing the high-risk priority constraint reduced it to 73.90%. In a prototype feasibility test with 100 concurrent requests and 1,000 total requests, mean risk-decision computation latency was 0.077 ms and P99 latency was 0.137 ms. The results demonstrate the feasibility of organizing heterogeneous runtime evidence and establishing an executable authorization-risk decision and coordinated-response loop without modifying application code, but do not establish general applicability in production environments.
Digital legacy systems must decide, without the account owner present to confirm intent, whether a request for emergency access to sensitive testamentary documents is legitimate. Existing approaches address this problem only partially: platform-specific legacy-contact features are not interoperable and require no independent corroboration, attribute- and role-based access control models regulate access during active use but are not designed for posthumous or inactivity-triggered release, and machine-learning-based anomaly detection improves suspicious-activity detection at the cost of data and computational requirements that are impractical for a lightweight, single-tenant application. This paper proposes and evaluates a behavioral risk-aware access control framework that unifies four mechanisms within a single architecture: (i) a rule-based behavioral risk-scoring engine that continuously derives a 0-100 risk value from failed-login and high-risk-action signals; (ii) a three-stage, checkpoint-based inactivity/liveness-detection algorithm that escalates from confirmation e-mails to an automatic emergency-access trigger; (iii) a threshold (2-of-3) multi-party authorization protocol that releases access only once independent trusted contacts submit single-use cryptographically random codes; and (iv) role-based access control combined with AES-256-CBC document encryption and full audit logging. We instantiate the framework in a working prototype, LegacyVault, built on Node.js, Express.js, and MySQL, and evaluate it through functional, performance, and security testing aligned to an explicit threat model covering credential compromise, trusted-contact collusion, and insider access. Testing shows that all implemented controls (authentication, encryption, threshold approval, inactivity escalation, and audit logging) operate as designed, with core operations completing in 1.2-7.0 seconds on a local test deployment. We discuss how the framework's design compares with role/attribute-based access control, single-party legacy-contact tools, and blockchain and ML-based alternatives, and we report the scale limitations of the present evaluation transparently rather than overstating a small, single-environment test as a production-grade security guarantee.
Hampo JohnPaul A.C., Kinyuy Marie-Noel Ngala, Fomukom Mark Nsah Tanyi et al.· World Journal of Advanced Re...· 0 citations
SafeGuard is presented, a lightweight three-tier client-server architecture for real-time endpoint monitoring, threat reporting, and administrative response that demonstrates that an open-source technology stack can provide real-time endpoint visibility and coordinated administrative response without commercial licensing costs.
Gideon Francis Oghie, DivineDavid Shittu Abolanle· 0 citations
The Model Context Protocol (MCP) enables LLM agents to interact with external tools through metadata exchange, tool invocation, and response consumption. Existing MCP security scanners primarily reason about suspicious semantic signals rather than real execution behaviors, which can lead to unreliable risk assessment. For example, credential-like strings may simply be placeholders rather than actual leakage. This gap requires runtime evidence for execution-related risks and careful semantic analysis for risks carried in metadata or returned content. We present FlowGuard, an evidence-grounded MCP security detection system. FlowGuard combines semantic risk triage, recon-guided payload narrowing, schema-valid probe generation, evidence adjudication, and history-guided refinement. It verifies execution-related risks through runtime evidence and detects semantic risks in tool metadata and returned content. We evaluate FlowGuard on an executable benchmark containing 1,880 MCP cases across five vulnerability categories. FlowGuard achieves F1 scores of 0.879 and 0.942 on the execution-related Command Injection and File System Access categories, respectively. Compared with existing dynamic scanners, FlowGuard reduces end-to-end latency by up to 2.23x. In the real-world evaluation, FlowGuard reports 523 findings across 326 servers. These results show that evidence-grounded detection can assess both execution-related and semantic risks in MCP interactions.
Baichao An, Pei Chen, Geng Hong et al.· 0 citations
Small enterprises face increasingly serious threats to their internal networks but often lack the financial resources, computing capacity, and specialist staff required to deploy resource intensive security platforms. This paper designs and implements VPID, a lightweight framework for vulnerability prioritization and intrusion detection that consists of two principal modules: controlled vulnerability validation and intelligent intrusion defense. The first module uses OpenVAS for asset mapping and vulnerability identification, applies a decision tree to prioritize vulnerabilities, and employs a rule engine to generate targeted validation payloads. The second module captures network traffic using Scapy, analyzes it through a detection pipeline that combines a decision tree with multinomial Naive Bayes, verifies traffic assessed as high risk using Snort rules, and performs blocking and alerting through iptables. The evaluation uses 550,000 network flow samples containing normal and attack traffic for detector training, together with 15,000 labeled vulnerability records. On the vulnerability ranking test set, the decision tree achieves a precision of 91.8%, a recall of 89.5%, and an F1 score of 90.6%. On an independent test set containing 55,000 traffic samples, the combined detection pipeline achieves a precision of 94.5%, a recall of 88.3%, and an F1 score of 91.3%, while maintaining a false positive rate below 1.5%.
Role-Based Access Control (RBAC) is widely used in web applications to regulate user permissions and resource access. Although effective at authorization, RBAC does not evaluate whether the behavior within an authenticated session is legitimate. As a result, threats such as credential misuse, insider attacks, and session hijacking may continue undetected even when requests satisfy existing access policies.To address this limitation, this paper presents RA-SFAD (Role-Aware Session Fingerprinting and Anomaly Detection), a lightweight framework for identifying abnormal user activity in RBAC-enabled environments. Instead of relying on a single behavioral model for all users, the framework constructs separate behavioral fingerprints for individual RBAC roles and monitors deviations from role-specific usage patterns. The detection pipeline combines per-role Isolation Forest models for identifying statistical anomalies with an LSTM-based sequence model that analyzes the temporal flow of user actions. In addition, SHAP (SHapley Additive exPlanations) is incorporated into the alerting mechanism to provide interpretable feature-level explanations for detected anomalies.The proposed framework was evaluated on a controlled dataset containing 5,800 labeled sessions distributed across three user roles. Experimental results show that RA-SFAD achieves 94% detection accuracy with an F1-score of 0.92 while maintaining a false positive rate of 4%, outperforming role-agnostic baseline approaches. The framework records an average detection latency of 420 ms and supports a throughput of approximately 2,400 sessions per second, indicating that it can operate efficiently on standard application server infrastructure. An ablation analysis further demonstrates that the role-aware modeling, hybrid detection strategy, and explainability module each contribute to the overall system performance.
H. K· International Conference Com...· 0 citations
Mobile-network operators must interpret spatial anomalies in aggregated cell-level telemetry and decide whether, where, and how to respond. This paper presents a privacy-conscious, intrusion detection system (IDS)-oriented triage and response architecture that consumes cell-level anomaly signatures and couples spatial reconstruction, short-horizon forecasting, origin inference, self-resolution and remaining-time estimation, adaptive gating, ETA-aware team selection, conservative redeployment, explanation, and audit logging. It is a downstream spatial-attribution and response-orchestration layer, not a packet- or flow-level attack detector. The evaluated configuration uses transparent deterministic, heuristic, and optimization-based procedures and synthetic aggregated signatures without subscriber identifiers; aggregation is treated as data minimization, not a formal privacy guarantee. Across 20 paired synthetic scenarios, the full policy reduced conditional mean response time from 37.58 to 22.86 min, total travel from 576.0 to 273.5 min, and coverage ETA from 32.28 to 26.76 min, while on-time service increased from 54.0% to 60.0%. These benefits were accompanied by lower persistent-incident coverage (91.1% to 72.1%) and a higher miss rate (8.9% to 27.9%). The inverse-origin configuration showed no repeated localization-error advantage, and conservative redeployment had only a marginal average effect. The results therefore demonstrate a configurable downstream triage trade-off under controlled synthetic conditions, not attack-classification accuracy, adversarial robustness, formal privacy, or deployment readiness.