Business Risk Analytics for API-Driven Digital Platforms: Measuring Mass Assignment Exposure in Developer Workflows

Authors

  • Hongmei Su 1 https://orcid.org/0009-0009-3296-6161
    • Conceptualization
    • Data Curation
    • Formal Analysis
    • Investigation
    • Methodology
    • Project Administration
    • Resources
    • Software
    • Validation
    • Writing – Original Draft Preparation
    • Writing – Review & Editing
    • Visualization
  • Duo Zhang 1,* https://orcid.org/0009-0006-1114-5936
    • Conceptualization
    • Data Curation
    • Formal Analysis
    • Methodology
    • Project Administration
    • Resources
    • Supervision
    • Validation
    • Writing – Review & Editing
    • Investigation
1 Faculty of Business, Information & Human Sciences, Kuala Lumpur University of Science & Technology, Kajang, Selangor, Malaysia 43000
Corresponding author: 472352533@qq.com

DOI:

https://doi.org/10.63646/EUCD6494

Keywords:

Api-driven digital platforms; business risk analytics; mass assignment exposure; developer workflows; restful API security; static analysis; dynamic verification; risk scoring

Abstract

API-driven digital platforms transform business processes into programmable services, but they also expose sensitive workflow states through request-response interfaces. Mass assignment exposure occurs when a server binds user-supplied fields directly to internal model objects without adequate field-level control, allowing unauthorized changes to roles, balances, ownership, verification states, or workflow status. This study develops a business risk analytics framework for measuring such exposure in developer workflows. The proposed Mass Assignment Exposure Index combines static indicators such as direct entity binding, sensitive-field setters, validation gaps, deserializer tolerance, cascade propagation, and service-layer copy logic with dynamic evidence from schema-aware injection tests. The Workflow Business Risk Score then weights exposure by asset value, identity sensitivity, regulatory impact, and remediation friction. A numerical evaluation based on three benchmark project classes and eight high-risk endpoint candidates shows that hybrid analytics reduces immediate actionability from eight static candidates to three confirmed high-impact exposures while preserving a backlog for fragile designs. Scenario analysis indicates that a hybrid risk policy prevents confirmed exposure without the workflow disruption produced by a static-only gate. The findings contribute to business and data analytics by converting API security telemetry into decision-oriented risk measures for release governance, internal audit, and platform control design.

How to Cite

Su, H., & Zhang, D. (2024). Business Risk Analytics for API-Driven Digital Platforms: Measuring Mass Assignment Exposure in Developer Workflows. Journal of Business and Data Analytics, 2(2), 20-41. https://doi.org/10.63646/EUCD6494

References

Akter, S., Wamba, S. F., Gunasekaran, A., Dubey, R., & Childe, S. J. (2016). How to improve firm performance using big data analytics capability and business strategy alignment. International Journal of Production Economics, 182, 113-131. https://doi.org/10.1016/j.ijpe.2016.08.018

Anderson, R. (2001). Why information security is hard: An economic perspective. Proceedings of the 17th Annual Computer Security Applications Conference, 358-365. https://doi.org/10.1109/ACSAC.2001.991552

Arcuri, A. (2019). RESTful API automated test case generation with EvoMaster. ACM Transactions on Software Engineering and Methodology, 28(1), Article 3. https://doi.org/10.1145/3293455

Atlidakis, V., Godefroid, P., & Polishchuk, M. (2019). RESTler: Stateful REST API fuzzing. Proceedings of the 41st International Conference on Software Engineering, 748-758. https://doi.org/10.1109/ICSE.2019.00083

Ayub Khan, A., Laghari, A. A., Shaikh, Z. A., Dacko-Pikiewicz, Z., & Kot, S. (2022). Internet of things (IoT) security with blockchain technology: A state-of-the-art review. IEEE Access, 10, 122679-122695. https://doi.org/10.1109/ACCESS.2022.3223370

Baniaș, O., Florea, D., Gyalai, R., & Curiac, D.-I. (2021). Automated specification-based testing of REST APIs. Sensors, 21(16), 5375. https://doi.org/10.3390/s21165375

Bhambhwani, S. M., & Huang, A. H. (2024). Auditing decentralized finance. The British Accounting Review, 56(2), 101270. https://doi.org/10.1016/j.bar.2023.101270

Bharadwaj, A., El Sawy, O. A., Pavlou, P. A., & Venkatraman, N. (2013). Digital business strategy: Toward a next generation of insights. MIS Quarterly, 37(2), 471-482. https://doi.org/10.25300/MISQ/2013/37:2.3

Böhme, M., Pham, V. T., & Roychoudhury, A. (2016). Coverage-based greybox fuzzing as Markov chain. Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security, 1032-1043. https://doi.org/10.1145/2976749.2978428

Boudreau, K. J. (2010). Open platform strategies and innovation: Granting access vs. devolving control. Management Science, 56(10), 1849-1872. https://doi.org/10.1287/mnsc.1100.1215

Breiman, L. (2001). Statistical modeling: The two cultures. Statistical Science, 16(3), 199-231. https://doi.org/10.1214/ss/1009213726

Broby, D. (2021). Financial technology and the future of banking. Financial Innovation, 7, Article 47. https://doi.org/10.1186/s40854-021-00264-y

Cavusoglu, H., Mishra, B., & Raghunathan, S. (2004). A model for evaluating IT security investments. Communications of the ACM, 47(7), 87-92. https://doi.org/10.1145/1005817.1005828

Ceccagnoli, M., Forman, C., Huang, P., & Wu, D. J. (2012). Cocreation of value in a platform ecosystem: The case of enterprise software. MIS Quarterly, 36(1), 263-290. https://doi.org/10.2307/41410417

Chen, H., Chiang, R. H. L., & Storey, V. C. (2012). Business intelligence and analytics: From big data to big impact. MIS Quarterly, 36(4), 1165-1188. https://doi.org/10.2307/41703503

Chen, L., Tong, T. W., Tang, S., & Han, N. (2022). Governance and design of digital platforms: A review and future research directions on a meta-organization. Journal of Management, 48(1), 147-184. https://doi.org/10.1177/01492063211045023

Corradini, D., Zampieri, A., Pasqua, M., Viglianisi, E., Dallago, M., & Ceccato, M. (2022). Automated black-box testing of nominal and error scenarios in RESTful APIs. Software Testing, Verification and Reliability, 32(5), e1808. https://doi.org/10.1002/stvr.1808

Dragoni, N., Giallorenzo, S., Lafuente, A. L., Mazzara, M., Montesi, F., Mustafin, R., & Safina, L. (2017). Microservices: Yesterday, today, and tomorrow. Present and Ulterior Software Engineering, 195-216. https://doi.org/10.1007/978-3-319-67425-4_12

Ed-douibi, H., Canovas Izquierdo, J. L., & Cabot, J. (2018). Automatic generation of test cases for REST APIs: A specification-based approach. IEEE 22nd International Enterprise Distributed Object Computing Conference, 181-190. https://doi.org/10.1109/EDOC.2018.00031

Egele, M., Brumley, D., Fratantonio, Y., & Kruegel, C. (2013). An empirical study of cryptographic misuse in Android applications. Proceedings of the 2013 ACM SIGSAC Conference on Computer and Communications Security, 73-84. https://doi.org/10.1145/2508859.2516693

Fahl, S., Harbach, M., Muders, T., Baumgärtner, L., Freisleben, B., & Smith, M. (2012). Why Eve and Mallory love Android: An analysis of Android SSL insecurity. Proceedings of the 2012 ACM Conference on Computer and Communications Security, 50-61. https://doi.org/10.1145/2382196.2382205

Gawer, A. (2014). Bridging differing perspectives on technological platforms: Toward an integrative framework. Research Policy, 43(7), 1239-1249. https://doi.org/10.1016/j.respol.2014.03.006

Goel, S., & Shawky, H. A. (2009). Estimating the market impact of security breach announcements on firm values. Information & Management, 46(7), 404-410. https://doi.org/10.1016/j.im.2009.06.005

Golmohammadi, A., Zhang, M., & Arcuri, A. (2024). Testing RESTful APIs: A survey. ACM Transactions on Software Engineering and Methodology, 33(1), Article 27. https://doi.org/10.1145/3617175

Gordon, L. A., & Loeb, M. P. (2002). The economics of information security investment. ACM Transactions on Information and System Security, 5(4), 438-457. https://doi.org/10.1145/581271.581274

Gordon, L. A., Loeb, M. P., & Lucyshyn, W. (2003). Sharing information on computer systems security: An economic analysis. Journal of Accounting and Public Policy, 22(6), 461-485. https://doi.org/10.1016/j.jaccpubpol.2003.09.001

Grover, V., Chiang, R. H. L., Liang, T. P., & Zhang, D. (2018). Creating strategic business value from big data analytics: A research framework. Journal of Management Information Systems, 35(2), 388-423. https://doi.org/10.1080/07421222.2018.1451951

Halfond, W. G. J., & Orso, A. (2005). AMNESIA: Analysis and monitoring for NEutralizing SQL-injection attacks. Proceedings of the 20th IEEE/ACM International Conference on Automated Software Engineering, 174-183. https://doi.org/10.1145/1101908.1101935

Han, H., Shiwakoti, R. K., Jarvis, R., Mordi, C., & Botchie, D. (2023). Accounting and auditing with blockchain technology and artificial intelligence: A literature review. International Journal of Accounting Information Systems, 48, 100598. https://doi.org/10.1016/j.accinf.2022.100598

Hasselbring, W., & Steinacker, G. (2017). Microservice architectures for scalability, agility and reliability in e-commerce. 2017 IEEE International Conference on Software Architecture Workshops, 243-246. https://doi.org/10.1109/ICSAW.2017.11

Jordan, M. I., & Mitchell, T. M. (2015). Machine learning: Trends, perspectives, and prospects. Science, 349(6245), 255-260. https://doi.org/10.1126/science.aaa8415

Jovanovic, N., Kruegel, C., & Kirda, E. (2006). Pixy: A static analysis tool for detecting web application vulnerabilities. IEEE Symposium on Security and Privacy, 258-263. https://doi.org/10.1109/SP.2006.29

Kamiya, S., Kang, J. K., Kim, J., Milidonis, A., & Stulz, R. M. (2021). Risk management, firm reputation, and the impact of successful cyberattacks on target firms. Journal of Financial Economics, 139(3), 719-749. https://doi.org/10.1016/j.jfineco.2019.05.019

Kannan, K., Rees, J., & Sridhar, S. (2007). Market reactions to information security breach announcements: An empirical analysis. International Journal of Electronic Commerce, 12(1), 69-91. https://doi.org/10.2753/JEC1086-4415120103

Kruchten, P., Nord, R. L., & Ozkaya, I. (2012). Technical debt: From metaphor to theory and practice. IEEE Software, 29(6), 18-21. https://doi.org/10.1109/MS.2012.167

Li, Z., Zou, D., Xu, S., Ou, X., Jin, H., Wang, S., Deng, Z., & Zhong, Y. (2018). VulDeePecker: A deep learning-based system for vulnerability detection. Proceedings of the 25th Annual Network and Distributed System Security Symposium. https://doi.org/10.14722/ndss.2018.23158

Livshits, V. B., & Lam, M. S. (2005). Finding security vulnerabilities in Java applications with static analysis. 14th USENIX Security Symposium. https://www.usenix.org/conference/14th-usenix-security-symposium/finding-security-vulnerabilities-java-applications-static

Manès, V. J. M., Han, H., Han, C., Cha, S. K., Egele, M., Schwartz, E. J., & Woo, M. (2021). The art, science, and engineering of fuzzing: A survey. IEEE Transactions on Software Engineering, 47(11), 2312-2331. https://doi.org/10.1109/TSE.2019.2946563

Martin-Lopez, A., Segura, S., & Ruiz-Cortés, A. (2021). RESTest: Automated black-box testing of RESTful web APIs. Proceedings of the 30th ACM SIGSOFT International Symposium on Software Testing and Analysis, 682-685. https://doi.org/10.1145/3460319.3469082

Mikalef, P., Boura, M., Lekakos, G., & Krogstie, J. (2020). The role of information governance in big data analytics driven innovation. Information & Management, 57(7), 103361. https://doi.org/10.1016/j.im.2020.103361

Mikalef, P., & Gupta, M. (2021). Artificial intelligence capability: Conceptualization, measurement calibration, and empirical study on its impact on organizational creativity and firm performance. Information & Management, 58(3), 103434. https://doi.org/10.1016/j.im.2021.103434

Nadi, S., Krüger, S., Mezini, M., & Bodden, E. (2016). Jumping through hoops: Why do Java developers struggle with cryptography APIs? Proceedings of the 38th International Conference on Software Engineering, 935-946. https://doi.org/10.1145/2884781.2884790

Nambisan, S., Lyytinen, K., Majchrzak, A., & Song, M. (2017). Digital innovation management: Reinventing innovation management research in a digital world. MIS Quarterly, 41(1), 223-238. https://doi.org/10.25300/MISQ/2017/41:1.03

Parker, G. G., & Van Alstyne, M. W. (2005). Two-sided network effects: A theory of information product design. Management Science, 51(10), 1494-1504. https://doi.org/10.1287/mnsc.1050.0400

Pieroni, A., Scarpato, N., & Felli, L. (2020). Blockchain and IoT convergence: A systematic survey on technologies, protocols and security. Applied Sciences, 10(19), 6749. https://doi.org/10.3390/app10196749

Provost, F., & Fawcett, T. (2013). Data science and its relationship to big data and data-driven decision making. Big Data, 1(1), 51-59. https://doi.org/10.1089/big.2013.1508

Rajmohan, T., Nguyen, P. H., & Ferry, N. (2022). A decade of research on patterns and architectures for IoT security. Cybersecurity, 5, Article 2. https://doi.org/10.1186/s42400-021-00104-7

Romanosky, S. (2016). Examining the costs and causes of cyber incidents. Journal of Cybersecurity, 2(2), 121-135. https://doi.org/10.1093/cybsec/tyw001

Russell, R., Kim, L., Hamilton, L., Lazovich, T., Harer, J., Ozdemir, O., Ellingwood, P., & McConley, M. (2018). Automated vulnerability detection in source code using deep representation learning. 17th IEEE International Conference on Machine Learning and Applications, 757-762. https://doi.org/10.1109/ICMLA.2018.00120

Scandariato, R., Walden, J., Hovsepyan, A., & Joosen, W. (2014). Predicting vulnerable software components via text mining. IEEE Transactions on Software Engineering, 40(10), 993-1006. https://doi.org/10.1109/TSE.2014.2340398

Schär, F. (2021). Decentralized finance: On blockchain- and smart contract-based financial markets. Federal Reserve Bank of St. Louis Review, 103(2), 153-174. https://doi.org/10.20955/r.103.153-74

Sculley, D., Holt, G., Golovin, D., Davydov, E., Phillips, T., Ebner, D., Chaudhary, V., Young, M., Crespo, J. F., & Dennison, D. (2015). Hidden technical debt in machine learning systems. Advances in Neural Information Processing Systems, 28, 2503-2511. https://proceedings.neurips.cc/paper_files/paper/2015/hash/86df7dcfd896fcaf2674f757a2463eba-Abstract.html

Shin, Y., Meneely, A., Williams, L., & Osborne, J. A. (2011). Evaluating complexity, code churn, and developer activity metrics as indicators of software vulnerabilities. IEEE Transactions on Software Engineering, 37(6), 772-787. https://doi.org/10.1109/TSE.2010.81

Shmueli, G., & Koppius, O. R. (2011). Predictive analytics in information systems research. MIS Quarterly, 35(3), 553-572. https://doi.org/10.2307/23042796

Tiwana, A., Konsynski, B., & Bush, A. A. (2010). Platform evolution: Coevolution of platform architecture, governance, and environmental dynamics. Information Systems Research, 21(4), 675-687. https://doi.org/10.1287/isre.1100.0323

Verhoef, P. C., Broekhuizen, T., Bart, Y., Bhattacharya, A., Dong, J. Q., Fabian, N., & Haenlein, M. (2021). Digital transformation: A multidisciplinary reflection and research agenda. Journal of Business Research, 122, 889-901. https://doi.org/10.1016/j.jbusres.2019.09.022

Wamba, S. F., Gunasekaran, A., Akter, S., Ren, S. J. F., Dubey, R., & Childe, S. J. (2017). Big data analytics and firm performance: Effects of dynamic capabilities. Journal of Business Research, 70, 356-365. https://doi.org/10.1016/j.jbusres.2016.08.009

Wassermann, G., & Su, Z. (2007). Sound and precise analysis of web applications for injection vulnerabilities. Proceedings of the 28th ACM SIGPLAN Conference on Programming Language Design and Implementation, 32-41. https://doi.org/10.1145/1250734.1250739

Yamaguchi, F., Golde, N., Arp, D., & Rieck, K. (2014). Modeling and discovering vulnerabilities with code property graphs. IEEE Symposium on Security and Privacy, 590-604. https://doi.org/10.1109/SP.2014.44

Ye, C., Cao, W., & Chen, S. (2021). Security challenges of blockchain in Internet of things: Systematic literature review. Transactions on Emerging Telecommunications Technologies, 32(8), e4177. https://doi.org/10.1002/ett.4177