Detecting Insufficient Access Control in Web Applications. - George Noseevich; Andrew Petukhov (SysSec@DIMVA, 2011)

Towards automated web application logic reconstruction for application level security. - George Noseevich; Dennis Gamayunov (CoRR, 2015)