Detecting Malicious Entra OAuth Apps with LLM-Based Permission Risk Scoring

TL;DR

This paper introduces a detection framework that uses large language models to assess permission risks and identify malicious OAuth apps in real-time within Microsoft Graph environments.

Contribution

It presents a novel unified framework combining permission corpus construction, LLM-based risk scoring, and real-time detection for malicious OAuth apps.

Findings

Effective identification of malicious OAuth apps.

High accuracy in risk scoring using LLMs.

Real-time detection capability demonstrated.

Abstract

This project presents a unified detection framework that constructs a complete corpus of Microsoft Graph permissions, generates consistent LLM-based risk scores, and integrates them into a real-time detection engine to identify malicious OAuth consent activity.