BYE BAC - AI-Powered Broken Access Control Detection Agent

AI Agent-based BAC Testing Framework v1.0.2Automated Detection of Broken Access Control Vulnerabilities Using LLM-Powered Intelligent Testing OverviewThis repository presents an AI agent-based framework for automated detection of Broken Access Control (BAC) vulnerabilities. The system leverages Large Language Models (LLMs) to intelligently generate test cases, perform automated resource discovery, and detect both IDOR (Insecure Direct Object Reference) and BOLA (Broken Object Level Authorization) vulnerabilities. The framework has been experimentally validated on real-world API endpoints and demonstrates strong performance in detection accuracy, coverage, consistency, and execution efficiency compared to manual testing approaches. Key Features- LLM Integration: Powered by Gemini 3.0 Pro Preview for intelligent test planning- Automated Discovery: Dynamic resource ID extraction without manual configuration- Dual Detection: IDOR (horizontal access) and BOLA (vertical privilege escalation)- Policy Validation: RBAC compliance checking- Deterministic Execution: Reproducible results across repeated runs- CI/CD Ready: Suitable for continuous security testing pipelines Performance Highlights- Execution Time: ~3 hours (manual) → ~73.6 seconds (automated) → 147× faster- Coverage: 50% → 100% → +50% improvement- Accuracy: 81.0% → 88.1% → +7.1% improvement- Consistency: Variable → 100% (deterministic)- Testing Frequency: Monthly → On-demand (~30× more frequent) Detection Metrics- Precision: 1.000 (100%) → Zero false positives- Recall: 0.797 (79.7%)- F1-Score: 0.887- Accuracy: 0.881 (88.1%) All metrics are derived from five independent executions using confusion matrix values:TP = 55, FP = 0, FN = 14, TN = 49. Experimental Validation- Endpoints Tested: 28 critical API endpoints- Roles: 3 (Admin, Employee, Employee_2)- Test Cases per Run: 168- Total Executions: 5 independent runs- Consistency: Identical results across all executions (deterministic behavior)- Average Execution Time: 73.60 seconds The system achieves perfect precision (no false positives), ensuring every detected vulnerability is valid. Remaining false negatives are primarily caused by dynamic business logic not captured by static RBAC modeling. ArchitectureThe framework follows a six-stage pipeline:Plan → Discover → Execute → Observe → Classify → Report Core Components:- Orchestrator: Workflow coordination- HttpClient: API communication with retry and connection pooling- AuthManager: Multi-role authentication and token management- Memory: Type-safe state management- Evaluators: Stateless vulnerability detection with policy-based rules- Reporters: JSON and Markdown report generation with AI summaries Research Contributions- LLM-powered automated security testing for BAC vulnerabilities- Deterministic and reproducible testing framework- Zero false positive detection (precision = 1.000)- Significant efficiency improvement (147× faster than manual testing)- Full coverage testing eliminating manual selection bias Limitations and Future Work- False negatives (FN = 14) remain due to dynamic business logic beyond static RBAC models- Future work includes: - Context-aware authorization modeling - Dynamic policy learning - Behavior-based access analysis CitationIf you use this tool in your research, please cite: Susanto, Caroline et al. (2025).Automated Detection of Broken Access Control Vulnerabilities Using AI Agent-Based Testing Framework.PeerJ Computer Science (submitted). LicenseMIT License © 2025 Caroline Susanto KeywordsBroken Access Control, IDOR, BOLA, API Security, Vulnerability Testing, AI Agent, LLM, Automated Testing, RBAC, Cybersecurity ContactGitHub: https://github.com/Carolinesnt/ai_agent_starterIssues: https://github.com/Carolinesnt/ai_agent_starter/issuesDiscussions: https://github.com/Carolinesnt/ai_agent_starter/discussions Version InformationVersion: 1.0.2Release Date: February 8, 2025Status: StablePlatform: Python 3.12.6, Ubuntu 24, Windows 11