FlagThis

Abstract

Objective: Authorization violations under valid Web sessions are difficult to identify and handle in real time from traffic because they depend strongly on business semantics and exhibit few distinctive protocol-level features. This paper proposes a non-intrusive traffic analysis framework for authorization risk detection and coordinated response. Methods: Requestresponse transactions are correlated to extract runtime context, including the access subject, business endpoint, object identifier, authentication state, and behavioral sequence. Objectaccess evidence, identity consistency, behavioral anomalies, authentication context, network environment, and endpoint-operation risk are mapped to interpretable risk components. Weighted fusion and high-risk priority constraints produce graded decisions that drive allow, alert, block, and external policy actions. The risk components are instantiated using deterministic and interpretable rules so that the study can evaluate multi-source evidence organization, risk fusion, and the coordinated-response loop at the framework level. Results: The controlled local testbed contained 2,000 balanced labeled samples, including 1,000 normal accesses and 1,000 authorization-risk events. The framework classified 998 of the 1,000 authorization-risk events as risky and produced no false positives among normal accesses. Accuracy, precision, recall, and F1 score were 99.90%, 100.00%, 99.80%, and 99.90%, respectively. Removing runtime object evidence reduced the F1 score to 81.31%, while removing the high-risk priority constraint reduced it to 73.90%. In a prototype feasibility test with 100 concurrent requests and 1,000 total requests, the mean risk-decision computation latency was 0.077 ms and the P99 latency was 0.137 ms. Conclusions: The controlled evaluation shows that the framework can organize heterogeneous runtime evidence and establish an executable authorization-risk decision and coordinated-response loop without modifying application code. The results demonstrate the feasibility of the overall mechanism in the specified validation scenarios, but do not establish general applicability in production environments.