Existing web-based security applications have failed in many situations due to the great intelligence of attackers.Among web applications,Cross-Site Scripting(XSS)is one of the dangerous assaults experienced while mod...Existing web-based security applications have failed in many situations due to the great intelligence of attackers.Among web applications,Cross-Site Scripting(XSS)is one of the dangerous assaults experienced while modifying an organization's or user's information.To avoid these security challenges,this article proposes a novel,all-encompassing combination of machine learning(NB,SVM,k-NN)and deep learning(RNN,CNN,LSTM)frameworks for detecting and defending against XSS attacks with high accuracy and efficiency.Based on the representation,a novel idea for merging stacking ensemble with web applications,termed“hybrid stacking”,is proposed.In order to implement the aforementioned methods,four distinct datasets,each of which contains both safe and unsafe content,are considered.The hybrid detection method can adaptively identify the attacks from the URL,and the defense mechanism inherits the advantages of URL encoding with dictionary-based mapping to improve prediction accuracy,accelerate the training process,and effectively remove the unsafe JScript/JavaScript keywords from the URL.The simulation results show that the proposed hybrid model is more efficient than the existing detection methods.It produces more than 99.5%accurate XSS attack classification results(accuracy,precision,recall,f1_score,and Receiver Operating Characteristic(ROC))and is highly resistant to XSS attacks.In order to ensure the security of the server's information,the proposed hybrid approach is demonstrated in a real-time environment.展开更多
Web应用程序天然存在多种漏洞,使得跨站脚本(Cross-site scripting,XSS)攻击实施简单但能产生较大危害,如何快速准确检测出XSS攻击是Web应用程序面临的一个难题。对此,基于单分类支持向量机(One Class Support Vector Machine,OCSVM)分...Web应用程序天然存在多种漏洞,使得跨站脚本(Cross-site scripting,XSS)攻击实施简单但能产生较大危害,如何快速准确检测出XSS攻击是Web应用程序面临的一个难题。对此,基于单分类支持向量机(One Class Support Vector Machine,OCSVM)分类器提出一个新的XSS攻击检测模型。采用基于TF-IDF算法的特征向量化方法,对XSS攻击样本进行分析;基于单分类模型,对样本数据进行训练及测试;从准确率、召回率及加权调和平均数三个指标对该模型的检测效果进行评价。实验结果表明,与现有检测方法相比,该检测模型具有更好的检测效果。展开更多
跨站脚本XSS(Cross Site Scripting)漏洞,已对大多数网站产生严重威胁。其中存储型XSS漏洞对用户及网站的损害尤为巨大。事先使用漏洞扫描工具对该漏洞进行检测并修补,可以有效预防和减轻该漏洞被利用后导致的一系列危害。分析存储型XS...跨站脚本XSS(Cross Site Scripting)漏洞,已对大多数网站产生严重威胁。其中存储型XSS漏洞对用户及网站的损害尤为巨大。事先使用漏洞扫描工具对该漏洞进行检测并修补,可以有效预防和减轻该漏洞被利用后导致的一系列危害。分析存储型XSS漏洞的攻击原理,提出用巴科斯范式(BNF)自动生成初始攻击向量,对初始攻击向量进行变异处理。使用辅助标记自动检测存储型XSS漏洞的动态检测方法,设计并实现存储型XSS漏洞检测系统。在现实Web应用中测试评估了该系统,实验证明它能有效检测出应用中存在的存储型XSS漏洞。展开更多
The advancement of technology and the digitization of organizational functions and services have propelled the world into a new era of computing capability and sophistication. The proliferation and usability of such c...The advancement of technology and the digitization of organizational functions and services have propelled the world into a new era of computing capability and sophistication. The proliferation and usability of such complex technological services raise several security concerns. One of the most critical concerns is cross-site scripting (XSS) attacks. This paper has concentrated on revealing and comprehensively analyzing XSS injection attacks, detection, and prevention concisely and accurately. I have done a thorough study and reviewed several research papers and publications with a specific focus on the researchers’ defensive techniques for preventing XSS attacks and subdivided them into five categories: machine learning techniques, server-side techniques, client-side techniques, proxy-based techniques, and combined approaches. The majority of existing cutting-edge XSS defensive approaches carefully analyzed in this paper offer protection against the traditional XSS attacks, such as stored and reflected XSS. There is currently no reliable solution to provide adequate protection against the newly discovered XSS attack known as DOM-based and mutation-based XSS attacks. After reading all of the proposed models and identifying their drawbacks, I recommend a combination of static, dynamic, and code auditing in conjunction with secure coding and continuous user awareness campaigns about XSS emerging attacks.展开更多
基金supported by the National Research Foundation of Korea(NRF)grant funded by the Korea government(MEST)No.2015R1A3A2031159,2016R1A5A1008055.
文摘Existing web-based security applications have failed in many situations due to the great intelligence of attackers.Among web applications,Cross-Site Scripting(XSS)is one of the dangerous assaults experienced while modifying an organization's or user's information.To avoid these security challenges,this article proposes a novel,all-encompassing combination of machine learning(NB,SVM,k-NN)and deep learning(RNN,CNN,LSTM)frameworks for detecting and defending against XSS attacks with high accuracy and efficiency.Based on the representation,a novel idea for merging stacking ensemble with web applications,termed“hybrid stacking”,is proposed.In order to implement the aforementioned methods,four distinct datasets,each of which contains both safe and unsafe content,are considered.The hybrid detection method can adaptively identify the attacks from the URL,and the defense mechanism inherits the advantages of URL encoding with dictionary-based mapping to improve prediction accuracy,accelerate the training process,and effectively remove the unsafe JScript/JavaScript keywords from the URL.The simulation results show that the proposed hybrid model is more efficient than the existing detection methods.It produces more than 99.5%accurate XSS attack classification results(accuracy,precision,recall,f1_score,and Receiver Operating Characteristic(ROC))and is highly resistant to XSS attacks.In order to ensure the security of the server's information,the proposed hybrid approach is demonstrated in a real-time environment.
文摘Web应用程序天然存在多种漏洞,使得跨站脚本(Cross-site scripting,XSS)攻击实施简单但能产生较大危害,如何快速准确检测出XSS攻击是Web应用程序面临的一个难题。对此,基于单分类支持向量机(One Class Support Vector Machine,OCSVM)分类器提出一个新的XSS攻击检测模型。采用基于TF-IDF算法的特征向量化方法,对XSS攻击样本进行分析;基于单分类模型,对样本数据进行训练及测试;从准确率、召回率及加权调和平均数三个指标对该模型的检测效果进行评价。实验结果表明,与现有检测方法相比,该检测模型具有更好的检测效果。
文摘跨站脚本XSS(Cross Site Scripting)漏洞,已对大多数网站产生严重威胁。其中存储型XSS漏洞对用户及网站的损害尤为巨大。事先使用漏洞扫描工具对该漏洞进行检测并修补,可以有效预防和减轻该漏洞被利用后导致的一系列危害。分析存储型XSS漏洞的攻击原理,提出用巴科斯范式(BNF)自动生成初始攻击向量,对初始攻击向量进行变异处理。使用辅助标记自动检测存储型XSS漏洞的动态检测方法,设计并实现存储型XSS漏洞检测系统。在现实Web应用中测试评估了该系统,实验证明它能有效检测出应用中存在的存储型XSS漏洞。
文摘The advancement of technology and the digitization of organizational functions and services have propelled the world into a new era of computing capability and sophistication. The proliferation and usability of such complex technological services raise several security concerns. One of the most critical concerns is cross-site scripting (XSS) attacks. This paper has concentrated on revealing and comprehensively analyzing XSS injection attacks, detection, and prevention concisely and accurately. I have done a thorough study and reviewed several research papers and publications with a specific focus on the researchers’ defensive techniques for preventing XSS attacks and subdivided them into five categories: machine learning techniques, server-side techniques, client-side techniques, proxy-based techniques, and combined approaches. The majority of existing cutting-edge XSS defensive approaches carefully analyzed in this paper offer protection against the traditional XSS attacks, such as stored and reflected XSS. There is currently no reliable solution to provide adequate protection against the newly discovered XSS attack known as DOM-based and mutation-based XSS attacks. After reading all of the proposed models and identifying their drawbacks, I recommend a combination of static, dynamic, and code auditing in conjunction with secure coding and continuous user awareness campaigns about XSS emerging attacks.
