{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,7,2]],"date-time":"2026-07-02T15:49:47Z","timestamp":1783007387075,"version":"3.54.5"},"reference-count":69,"publisher":"Institute of Electrical and Electronics Engineers (IEEE)","license":[{"start":{"date-parts":[[2025,1,1]],"date-time":"2025-01-01T00:00:00Z","timestamp":1735689600000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/ieeexplore.ieee.org\/Xplorehelp\/downloads\/license-information\/IEEE.html"},{"start":{"date-parts":[[2025,1,1]],"date-time":"2025-01-01T00:00:00Z","timestamp":1735689600000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-029"},{"start":{"date-parts":[[2025,1,1]],"date-time":"2025-01-01T00:00:00Z","timestamp":1735689600000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-037"}],"funder":[{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["U2436207"],"award-info":[{"award-number":["U2436207"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["62172105"],"award-info":[{"award-number":["62172105"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["62202106"],"award-info":[{"award-number":["62202106"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]},{"name":"Shanghai Pilot Program for Basic Research-Fudan University","award":["21TQ1400100 (21TQ012)"],"award-info":[{"award-number":["21TQ1400100 (21TQ012)"]}]},{"name":"Hong Kong RGC Projects","award":["PolyU15224121"],"award-info":[{"award-number":["PolyU15224121"]}]},{"name":"Hong Kong RGC Projects","award":["PolyU15231223"],"award-info":[{"award-number":["PolyU15231223"]}]},{"name":"HKPolyU Project","award":["ZGGG"],"award-info":[{"award-number":["ZGGG"]}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["IEEE Trans.Inform.Forensic Secur."],"published-print":{"date-parts":[[2025]]},"DOI":"10.1109\/tifs.2025.3614424","type":"journal-article","created":{"date-parts":[[2025,9,25]],"date-time":"2025-09-25T17:54:06Z","timestamp":1758822846000},"page":"10683-10698","source":"Crossref","is-referenced-by-count":1,"title":["Facilitating Access Control Vulnerability Detection in Modern Java Web Applications With Accurate Permission Check Identification"],"prefix":"10.1109","volume":"20","author":[{"ORCID":"https:\/\/orcid.org\/0009-0004-0763-4732","authenticated-orcid":false,"given":"Youkun","family":"Shi","sequence":"first","affiliation":[{"name":"School of Computer Science and Technology, Fudan University, Shanghai, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0009-0009-4680-6513","authenticated-orcid":false,"given":"Fengyu","family":"Liu","sequence":"additional","affiliation":[{"name":"School of Computer Science and Technology, Fudan University, Shanghai, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-7066-0109","authenticated-orcid":false,"given":"Guangliang","family":"Yang","sequence":"additional","affiliation":[{"name":"School of Computer Science and Technology, Fudan University, Shanghai, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-0726-9996","authenticated-orcid":false,"given":"Yuan","family":"Zhang","sequence":"additional","affiliation":[{"name":"School of Computer Science and Technology, Fudan University, Shanghai, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-9618-4830","authenticated-orcid":false,"given":"Yinzhi","family":"Cao","sequence":"additional","affiliation":[{"name":"Department of Computer Science, Johns Hopkins University, Baltimore, MD, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0009-0006-8141-7319","authenticated-orcid":false,"given":"Enhao","family":"Li","sequence":"additional","affiliation":[{"name":"School of Computer Science and Technology, Fudan University, Shanghai, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0009-0009-9018-0386","authenticated-orcid":false,"given":"Xin","family":"Tan","sequence":"additional","affiliation":[{"name":"School of Computer Science and Technology, Fudan University, Shanghai, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-9082-3208","authenticated-orcid":false,"given":"Xiapu","family":"Luo","sequence":"additional","affiliation":[{"name":"Department of Computing, The Hong Kong Polytechnic University, Hong Kong, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-9714-5545","authenticated-orcid":false,"given":"Min","family":"Yang","sequence":"additional","affiliation":[{"name":"School of Computer Science and Technology, Fudan University, Shanghai, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0009-0005-8448-689X","authenticated-orcid":false,"given":"Siyi","family":"Chen","sequence":"additional","affiliation":[{"name":"Alibaba Group, Hangzhou, China"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"263","reference":[{"key":"ref1","volume-title":"Amazon","year":"2025"},{"key":"ref2","volume-title":"Microsoft","year":"2025"},{"key":"ref3","volume-title":"EBay","year":"2025"},{"key":"ref4","volume-title":"Alibaba","year":"2025"},{"key":"ref5","volume-title":"Java Development Framework Spring","year":"2025"},{"key":"ref6","doi-asserted-by":"publisher","DOI":"10.1145\/3551349.3556910"},{"key":"ref7","volume-title":"Apache Struts Framework","year":"2025"},{"key":"ref8","volume-title":"The OWASP Top 10-2013","year":"2013"},{"key":"ref9","volume-title":"The OWASP Top 10-2017","year":"2017"},{"key":"ref10","volume-title":"OWASP Top 10","year":"2021"},{"key":"ref11","first-page":"1","article-title":"Fix me up: Repairing access-control bugs in web applications","volume-title":"Proc. NDSS","author":"Son"},{"key":"ref12","doi-asserted-by":"publisher","DOI":"10.1145\/2660267.2660337"},{"key":"ref13","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2016.23046"},{"key":"ref14","first-page":"1205","article-title":"PeX: A permission check analysis framework for Linux kernel","volume-title":"Proc. 28th USENIX Secur. Symp.","author":"Zhang"},{"key":"ref15","doi-asserted-by":"publisher","DOI":"10.1145\/3548606.3560589"},{"key":"ref16","doi-asserted-by":"publisher","DOI":"10.1109\/SP61157.2025.00011"},{"key":"ref17","doi-asserted-by":"publisher","DOI":"10.1109\/TDSC.2024.3525049"},{"key":"ref18","doi-asserted-by":"publisher","DOI":"10.1109\/SP54263.2024.00013"},{"key":"ref19","doi-asserted-by":"publisher","DOI":"10.1145\/2048066.2048146"},{"key":"ref20","volume-title":"Android Permission Overview","year":"2025"},{"key":"ref21","first-page":"379","article-title":"AutoISES: Automatically inferring security specification and detecting violations","volume-title":"Proc. USENIX Secur. Symp.","author":"Tan"},{"key":"ref22","volume-title":"Github","year":"2025"},{"key":"ref23","volume-title":"Java Naming Conventions","year":"2025"},{"key":"ref24","volume-title":"Java Tutorials","year":"2025"},{"key":"ref25","volume-title":"Java Documentation","year":"2025"},{"key":"ref26","volume-title":"CodeQL","year":"2025"},{"key":"ref27","volume-title":"Google Java Style Guide","year":"2025"},{"key":"ref28","volume-title":"WordNet","year":"2025"},{"key":"ref29","volume-title":"The Document of Python Library: WordNet","year":"2025"},{"key":"ref30","first-page":"580","article-title":"Fast algorithms for mining association rules","volume-title":"Proc. 20th int. conf. very large data bases","author":"Agrawal"},{"key":"ref31","volume-title":"The Official Document of MyBatis","year":"2025"},{"key":"ref32","volume-title":"Spring Framework","year":"2025"},{"key":"ref33","volume-title":"Lamp-Boot","year":"2025"},{"key":"ref34","volume-title":"PublicCMS","year":"2025"},{"key":"ref35","volume-title":"FlyCMS","year":"2025"},{"key":"ref36","volume-title":"MyBatis Generator","year":"2025"},{"key":"ref37","first-page":"1","article-title":"The soot framework for Java program analysis: A retrospective","volume-title":"Proc. Cetus Users Compiler Infastructure Workshop (CETUS)","author":"Lam"},{"key":"ref38","volume-title":"WALA","year":"2025"},{"key":"ref39","first-page":"11","article-title":"Static detection of access control vulnerabilities in web applications","volume-title":"Proc. 20th USENIX Secur. Symp.","author":"Sun"},{"key":"ref40","doi-asserted-by":"publisher","DOI":"10.1145\/2076732.2076767"},{"key":"ref41","doi-asserted-by":"publisher","DOI":"10.1016\/j.jnca.2018.01.008"},{"key":"ref42","doi-asserted-by":"publisher","DOI":"10.1049\/iet-sen.2019.0186"},{"key":"ref43","doi-asserted-by":"publisher","DOI":"10.1145\/2484313.2484375"},{"key":"ref44","doi-asserted-by":"publisher","DOI":"10.1145\/2557547.2557552"},{"key":"ref45","doi-asserted-by":"publisher","DOI":"10.1145\/2884781.2884836"},{"key":"ref46","doi-asserted-by":"publisher","DOI":"10.1016\/j.jss.2021.111109"},{"key":"ref47","doi-asserted-by":"publisher","DOI":"10.1007\/s42979-022-01271-1"},{"key":"ref48","doi-asserted-by":"publisher","DOI":"10.1109\/SP61157.2025.00010"},{"key":"ref49","doi-asserted-by":"publisher","DOI":"10.1145\/3658644.3690227"},{"key":"ref50","doi-asserted-by":"publisher","DOI":"10.1109\/EuroSP.2017.14"},{"key":"ref51","doi-asserted-by":"publisher","DOI":"10.1145\/2660267.2660363"},{"key":"ref52","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2014.23262"},{"key":"ref53","first-page":"989","article-title":"Static detection of second-order vulnerabilities in web applications","volume-title":"Proc. USENIX Secur. Symp.","author":"Dahse"},{"key":"ref54","doi-asserted-by":"publisher","DOI":"10.1145\/3548606.3559391"},{"key":"ref55","doi-asserted-by":"publisher","DOI":"10.1145\/3338906.3338933"},{"key":"ref56","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2014.44"},{"key":"ref57","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2021.24550"},{"key":"ref58","first-page":"523","article-title":"Enemy of the state: A state-aware black-box web vulnerability scanner","volume-title":"Proc. 21st USENIX Secur. Symp.","author":"Doup\u00e9"},{"key":"ref59","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2023.24169"},{"key":"ref60","doi-asserted-by":"publisher","DOI":"10.1109\/SP40001.2021.00022"},{"key":"ref61","doi-asserted-by":"publisher","DOI":"10.1145\/3133956.3133959"},{"key":"ref62","doi-asserted-by":"publisher","DOI":"10.1109\/SP46215.2023.10179317"},{"key":"ref63","first-page":"4765","article-title":"Atropos: Effective fuzzing of web applications for server-side vulnerabilities","volume-title":"Proc. 33rd USENIX Secur. Symp.","author":"G\u00fcler"},{"key":"ref64","doi-asserted-by":"publisher","DOI":"10.1145\/3576915.3616582"},{"key":"ref65","first-page":"197","article-title":"FUGIO: Automatic exploit generation for PHP object injection vulnerabilities","volume-title":"Proc. 31st USENIX Secur. Symp.","author":"Park"},{"key":"ref66","doi-asserted-by":"publisher","DOI":"10.1109\/DSN.2019.00064"},{"key":"ref67","first-page":"377","article-title":"NAVEX: Precise and scalable exploit generation for dynamic web applications","volume-title":"Proc. 27th USENIX Secur. Symp. (USENIX Security)","author":"Alhuzali"},{"key":"ref68","doi-asserted-by":"publisher","DOI":"10.1145\/2976749.2978380"},{"key":"ref69","doi-asserted-by":"publisher","DOI":"10.1145\/3442381.3450002"}],"container-title":["IEEE Transactions on Information Forensics and Security"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx8\/10206\/10810755\/11180138.pdf?arnumber=11180138","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,10,15]],"date-time":"2025-10-15T17:36:21Z","timestamp":1760549781000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/11180138\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2025]]},"references-count":69,"URL":"https:\/\/doi.org\/10.1109\/tifs.2025.3614424","relation":{},"ISSN":["1556-6013","1556-6021"],"issn-type":[{"value":"1556-6013","type":"print"},{"value":"1556-6021","type":"electronic"}],"subject":[],"published":{"date-parts":[[2025]]}}}