Cross-Site Scripting (XSS) Detection Integrating Evidences in Multiple Stages

Abstract

As Cross-Site Scripting (XSS) remains one of the top web security risks, people keep exploring ways to detect such attacks efficiently. So far, existing solutions only focus on the payload in a web request or a response, a single stage of a web transaction. This work proposes a new approach that integrates evidences from both a web request and its response in order to better characterize XSS attacks and separate them from normal web transactions. We first collect complete payloads of XSS and normal web transactions from two databases and extract features from them using the Word2vec technique. Next, we train two Gaussian mixture models (GMM) with these features, one for XSS transaction and one for normal web transactions. These two models can generate two probability scores for a new web transaction, which indicate how similar this web transaction is to XSS and normal traffics respectively. Finally, we put together these two GMM models in classification by combining these two probabilities to further improve detection accuracy.

GeneMiner: A Classification Approach for Detection of XSS Attacks on Web Services

“…Zhang et al [ 30 ] extracted features from XSS payloads using word2vec and trained the dataset using two unsupervised clustering techniques, Gaussian mixture models (GMMs). Zhang et al [ 30 ] built two GMMs for detecting XSS in web request and web response packets.…”

“…Zhang et al [ 30 ] extracted features from XSS payloads using word2vec and trained the dataset using two unsupervised clustering techniques, Gaussian mixture models (GMMs). Zhang et al [ 30 ] built two GMMs for detecting XSS in web request and web response packets. The XSS payloads are distinguished as two clusters with two different Gaussian functions characterized by the mean and covariance of the data points in a dataset.…”

“…Liu et al [ 25 ] applied graph convolution networks, and Abimov and Bianchi [ 49 ] used convolutional deep neural network (CNN) for the detection of XSS attacks. Zhou et al [ 21 , 30 ] applied machine learning techniques, [ 33 ] applied a genetic algorithm along with reinforcement learning to detect XSS attacks, and [ 50 ] detected reflected XSS attacks using reinforced learning. It is observed that only 06 out of 16 articles focused on evolutionary algorithms for the detection of XSS attacks, while only 01 focused on XML injection [ 51 , 52 ].…”

“…The existing approaches of XSS attack detection using generative adversarial network [ 30 ] have an accuracy rate of 94.59%, and enforcement learning [ 21 ] reaches an accuracy up to 97.78, using deep neural network [ 20 ] (with an accuracy of 91.7%). Other machine learning techniques detect XSS payloads with less than 90% accuracy.…”

Twenty-two years since revealing cross-site scripting attacks: a systematic mapping and a comprehensive survey

“…Zhang et al [119] used two separate Gaussian mixture models (GMM) trained on normal and XSS payloads respectively. The produced probabilities of the two GMMs on tested payloads are compared to reach a final prediction.…”