HTTP REST API Structure Learning

Patch-Guided Vulnerability Detection: Extracting Java API Security Rules via Attack–Defense Cross-Analysis

Predictive Web Application Security Using Intelligent SQL Injection Detection

Web applications have become an essential part of modern businesses, making them a common target for cyberattacks. Among various security threats, SQL injection remains one of the most dangerous because it allows attackers to manipulate database queries and gain unauthorized access to sensitive information. Traditional detection techniques often rely on predefined rules or signatures, which are less effective against newly emerging attack patterns. This work presents an intelligent approach for improving web application security through the prediction and detection of SQL injection attacks using machine learning techniques. The proposed framework processes SQL queries by performing data cleaning, feature extraction, and text preprocessing before training an ensemble classification model. The trained model distinguishes normal queries from malicious ones with high accuracy, enabling early identification of potential attacks. Performance is evaluated using standard metrics such as accuracy, precision, recall, and F1-score to verify the effectiveness of the system. The developed framework also provides a simple interface for analyzing new SQL queries and predicting their security status. This approach supports proactive protection of web applications by enabling faster, more reliable, and automated detection of SQL injection vulnerabilities.

Response-Level Identification of Cloud API Misconfigurations Using Large Language Models †

Application Programming Interfaces (APIs) are a set of rules that enable communication, data exchange, and automated interactions between applications and services. With the rapid advancement of cloud computing, APIs have evolved from simple data-access interfaces into critical components for managing, configuring, and orchestrating cloud resources. Most modern cloud platforms rely on RESTful APIs for provisioning cloud resources, applying configurations, and maintaining services. As a result, APIs misconfigurations have become a critical cloud security threat that can lead to sensitive data exposure, unauthorized access, or operational disruptions. Identifying these misconfigurations is challenging because traditional rule-based and static analysis methods often fail to capture complex, context-dependent configuration issues and system behaviors. In this study, we investigate the use of Large Language Models (LLMs) to detect security misconfigurations directly from cloud API response data. By treating API responses as representations of a system’s configuration state, we assess whether LLMs can effectively identify potential security risks. We evaluate five LLMs using a unified zero-shot prompting approach and compare their performance with and without Retrieval-Augmented Generation (RAG) to understand the impact of external knowledge on misconfiguration detection. The study not only focuses on each model’s ability to identify configuration components and detect misconfigurations, but also evaluates their capability to accurately determine the number of misconfigurations and generate clear, actionable security explanations. Our preliminary results show that Meta Llama Instruct combined with RAG achieves the reliable performance for identifying security misconfigurations in cloud API responses. This study provides new insights into the practicality of LLM-driven API cloud security analysis and paves the way for future research.

BSM: A Browser-Resident Framework for Real-Time Detection of JavaScript API Abuse and Prompt Injection Attacks

As web applications embed both dynamic JavaScript and AI services, they expose browser APIs to two runtime threats that are rarely addressed together: JavaScript code injection and prompt injection. This paper presents Browser Security Monitor (BSM), a browser-resident framework that instruments sensitive window object APIs to intercept and analyze dynamic JavaScript execution in real time. BSM integrates weighted behavioral pattern matching using Deterministic Finite Automata (DFA) with empirically derived risk scores and a lightweight keyword and linguistic feature filter for direct prompt injection. We evaluate BSM across production deployment, static malware analysis, and prompt injection detection. Field deployment across 47 production websites monitored 50,732 API events (6,559 fetch and 44,173 eval() invocations) with zero false positives. Static evaluation on 1,109 samples (1,061 malicious from the Petrak collection and 48 benign production libraries) reports 98.4% precision, 59.6% recall, and 79.2% specificity at the browser-deployment threshold $T=40$ , with an AUROC of 0.60 reflecting a discrete weighted scoring design that trades ranking quality for sub-millisecond latency; a Random Forest baseline on the same features reaches AUC-ROC 0.98 but a 52.0% false-positive rate unusable for browser deployment. Applied to the static evaluation, a SHA-256 content-hash access list over canonical CDN library versions raises specificity to 100.0% with no measurable change in malicious-sample recall. On 1,695 labeled prompts, the prompt injection module yields 45.9% recall, 92.5% precision, 96.8% specificity, and F1 = 0.614, while detecting 0 of 20 paraphrased attacks, an explicit keyword evasion boundary. An adversarial robustness evaluation across five transformation families shows 90% evasion once the literal eval() token is stripped, quantifying the rule-based detection ceiling. BSM does not address indirect prompt injection, binary-payload malware, or polymorphic JavaScript outside the nine-pattern set. Detection latency stays within 0.3 to 0.8 ms and memory within 25 to 35 MB. BSM’s contribution is integrative rather than algorithmic: no individual technique is novel in isolation, and the value lies in combining JavaScript API-abuse detection and direct prompt injection detection in a single browser-resident, sub-millisecond, low-memory extension validated on 47 live production sites. BSM is a precision-first, low-overhead client-side filter that complements rather than replaces server-side and model-internal defenses.

Static Code Analysis Framework for Automated Security Vulnerability Detection

Experimental results show that AST-based structural features substantially improve recall compared with the TF-IDF baseline, while the combined TF-IDF and AST representation maintains this improved performance.

HawkEye: Web Vulnerability Analysis and Security Audit Tool

HawkEye is introduced, a modular, web-based vulnerability auditing platform designed to streamline security analysis by integrating multiple scanning tools within a unified dashboard and illustrates how consolidated reporting improves vulnerability prioritization for development teams.