Towards a Lightweight, Hybrid Approach for Detecting DOM XSS Vulnerabilities with Machine Learning

Abstract

Client-side cross-site scripting (DOM XSS) vulnerabilities in web applications are common, hard to identify, and difficult to prevent. Taint tracking is the most promising approach for detecting DOM XSS with high precision and recall, but is too computationally expensive for many practical uses.We investigate whether machine learning (ML) classifiers can replace or augment taint tracking when detecting DOM XSS vulnerabilities. Through a large-scale web crawl, we collect over 18 billion JavaScript functions and use taint tracking to label over 180,000 functions as potentially vulnerable. With this data, we train a deep neural network (DNN) to analyze a JavaScript function and predict if it is vulnerable to DOM XSS. We experiment with a range of hyperparameters and present a low-latency, high-recall classifier that could serve as a pre-filter to taint tracking, reducing the cost of stand-alone taint tracking by 3.43× while detecting 94.5% of unique vulnerabilities. We argue that this combination of a DNN and taint tracking is efficient enough for a range of use cases for which taint tracking by itself is not, including in-browser run-time DOM XSS detection and analyzing large codebases. CCS CONCEPTS• Security and privacy → Web application security; • Information systems → World Wide Web; • Computing methodologies → Machine learning.

GeneMiner: A Classification Approach for Detection of XSS Attacks on Web Services

“…Melicher et al [ 17 ] trained deep neural network using taint tracking methods to predict the vulnerability of payloads by analyzing JavaScript functions. Liu et al proposed an approach GraphXSS, for the detection of XSS attacks, which converted an XSS payload into a graph of interconnected words and characters.…”

“…Fang et al [ 14 , 20 ] performed decoding of XSS payloads and applied neural network techniques to identify malicious XSS payloads. Lei et al [ 15 ] used the LSTM model for XSS detection, and Melicher et al [ 17 ] applied deep neural network for detecting DOM-based XSS attacks. Liu et al [ 25 ] applied graph convolution networks, and Abimov and Bianchi [ 49 ] used convolutional deep neural network (CNN) for the detection of XSS attacks.…”

“…Machine learning (ML) [9][10][11][12][13] and neural network (NN) [14][15][16][17] techniques have recently been used to detect XSS vulnerability in source code. Genetic algorithms and fuzzy inference are combined with ML and NN to generate a large number of permutations and combinations of payloads using the existing datasets to mitigate the newer adversarial attacks [18][19][20][21].…”

Twenty-two years since revealing cross-site scripting attacks: a systematic mapping and a comprehensive survey

“…• Hybrid dynamic analysis: hybrid dynamic analysis combines two or more dynamic analysis techniques for the detection of injection vulnerabilities. Two hybrid solutions have been found in the literature [157,105]. Melicher et al [157] proposed and experimented the use of a deep learning model as a pre-filter for a dynamic taint-tracker.…”

“…Two hybrid solutions have been found in the literature [157,105]. Melicher et al [157] proposed and experimented the use of a deep learning model as a pre-filter for a dynamic taint-tracker. A deep learner model is used to check the vulnerability of JavaScript codes, only unconfirmed malicious samples are subject to a dynamic taint-tracker for analysis.…”