Detecting Insufficient Access Control in Web Applications. - George Noseevich; Andrew Petukhov (SysSec@DIMVA, 2011)