Uma abordagem para a detecção de ataques a vulnerabilidades lógicas de adulteração de parâmetros e controles de acesso em apis web rest utilizando redes de petri coloridas

Abstract

REST Web APIs are widely used for system integration, but their growth has introduced security challenges, such as logical vulnerabilities, which are difficult to detect with traditional automated methods. Among these flaws, Broken Object Level Authorization (BOLA) stands out, as it allows unauthorized users to access ormodifyrestricteddata. ThisthesisproposesanapproachbasedonColoredPetri Nets to detect attacks on logical vulnerabilities in REST APIs by transforming OpenAPI specifications into formal models and analyzing server logs to identify discrepancies between expected and observed behavior. To validate the approach, the Links2CPN tool was developed, which automatically performs the model transformation and attack detection. In three vulnerable application scenarios, the solution demonstrated over 95% accuracy and precision in identifying BOLA attack attempts. The results show that the combination of formal modeling and log analysis is capable of detecting logical vulnerabilities, offering a viable alternative for improving the security of REST APIs.