Automatic Learning and Enforcement of Authorization Rules in Online Social Networks

Learn about an innovative defense-in-depth system called Invariant Detector (IVD) designed to automatically learn and enforce authorization rules in online social networks. Explore how IVD addresses the challenges of preventing authorization bugs by learning from normal data manipulation patterns and distilling them into likely invariants. Discover the system's implementation at Facebook, where it infers and evaluates over 200,000 invariants daily from a sample of roughly 500 million client requests. Gain insights into IVD's effectiveness in detecting high-impact authorization bugs and blocking exploitation attempts before code fixes are deployed. Delve into the system's design goals, insights, two-step invariant learning process, and runtime enforcement strategies.

Intro
In a Nutshell
Authorization Bug Example
The Bug Fix
At Scale Challenges
Invariant Design Goals
Invariant Design Insights
Two-step Invariant Learning
Runtime Enforcement Excuses
Conclusion