一句话：提出基于静态辅助动态分析与 Proxy 污点追踪的 EDE 检测工具 Mockingbird，并发布 EDEBench 基准。
过度数据暴露（EDE）是 API 返回超出功能所需数据的安全威胁，自动化检测仍不成熟，黑盒模糊测试在准确率和效率上存在瓶颈。Mockingbird 采用静态辅助的动态分析，利用 JavaScript Proxy 实现动态污点追踪，识别从 API 响应传到客户端却从未被 UI 渲染或状态管理等预期功能消费的悬空数据。作者构建并开源首个 EDE 基准 EDEBench，含 8 个不同现代技术栈的 Web 项目。实验显示，与 SOTA 相比，平均 F1 提升 24.1%（精确率 +15.8%、召回率 +32.8%），检测速度提升近 20 倍，并广泛适用于所测框架。
Excessive Data Exposure (EDE), where an API returns redundant data to the client beyond what is required for its functionality, has become a pervasive and severe security threat. However, automated detection techniques for such vulnerabilities remain underdeveloped, and existing methods, particularly black-box fuzzing, face significant bottlenecks in terms of accuracy and efficiency. To address these challenges, we propose Mockingbird, an automated detection tool based on a statically-assisted dynamic analysis approach. The tool leverages the JavaScript Proxy mechanism for efficient dynamic taint tracking to precisely identify the dangling data that is transmitted from an API response to the client but never consumed by any expected functionality, such as UI rendering or state management. Furthermore, to tackle the lack of a standardized benchmark in this domain, we have constructed and open-sourced EDEBench, the first persistent benchmark for EDE evaluation, comprising 8 popular open-source web projects built on diverse modern technology stacks. Experimental evaluation on EDEBench shows that, compared to the state-of-the-art, Mockingbird achieves an average F1-score improvement of 24.1% (Precision +15.8%, Recall +32.8%), enhances detection speed by nearly 20 times, and demonstrates broad applicability across all tested frameworks. These results provide a clear illustration of our tool’s accuracy, applicability, and efficiency. The source code is available at https://github.com/NeoSunJZ/Mockingbird-JS.
DOI 原文 ·
@inproceedings{paperbot9485,
title = {Mockingbird: Efficient Excessive Data Exposures Detection via Dynamic Code Instrumentation},
author = {Chenxiao Xia and Jiazheng Sun and Jun Zheng and Yu-an Tan and Hongyi Su},
booktitle = {ASE},
year = {2025},
doi = {10.1109/ase63991.2025.00247}
}