XSSClassifier: An Efficient XSS Attack Detection Approach Based on Machine Learning Classifier on SNSs
0
조회
0
다운로드
5
인용
0
참고문헌
키워드
초록
Social networking services (SNSs) such as Twitter, MySpace, and Facebook have become progressivelysignificant with its billions of users. Still, alongside this increase is an increase in security threats such as crosssitescripting (XSS) threat. Recently, a few approaches have been proposed to detect an XSS attack on SNSs. Due to the certain recent features of SNSs webpages such as JavaScript and AJAX, however, the existingapproaches are not efficient in combating XSS attack on SNSs. In this paper, we propose a machine learningbasedapproach to detecting XSS attack on SNSs. In our approach, the detection of XSS attack is performedbased on three features: URLs, webpage, and SNSs. A dataset is prepared by collecting 1,000 SNSs webpagesand extracting the features from these webpages. Ten different machine learning classifiers are used on aprepared dataset to classify webpages into two categories: XSS or non-XSS. To validate the efficiency of theproposed approach, we evaluated and compared it with other existing approaches. The evaluation resultsshow that our approach attains better performance in the SNS environment, recording the highest accuracy of0.972 and lowest false positive rate of 0.87.
Abstract
Social networking services (SNSs) such as Twitter, MySpace, and Facebook have become progressivelysignificant with its billions of users. Still, alongside this increase is an increase in security threats such as crosssitescripting (XSS) threat. Recently, a few approaches have been proposed to detect an XSS attack on SNSs. Due to the certain recent features of SNSs webpages such as JavaScript and AJAX, however, the existingapproaches are not efficient in combating XSS attack on SNSs. In this paper, we propose a machine learningbasedapproach to detecting XSS attack on SNSs. In our approach, the detection of XSS attack is performedbased on three features: URLs, webpage, and SNSs. A dataset is prepared by collecting 1,000 SNSs webpagesand extracting the features from these webpages. Ten different machine learning classifiers are used on aprepared dataset to classify webpages into two categories: XSS or non-XSS. To validate the efficiency of theproposed approach, we evaluated and compared it with other existing approaches. The evaluation resultsshow that our approach attains better performance in the SNS environment, recording the highest accuracy of0.972 and lowest false positive rate of 0.87.
참고문헌 (29)
- 이다니엘, "Personalizing Information Using Users’ Online Social Networks: A Case Study of CiteULike", JIPS(Journal of Information Processing Systems), 11(1), pp.1~21 (2015), 한국정보처리학회[DOI]
- 김진숙, "WebSHArk 1.0: A Benchmark Collection for Malicious Web Shell Detection", JIPS(Journal of Information Processing Systems), 11(2), pp.229~238 (2015), 한국정보처리학회[DOI]
- Y. Zhang, "Cross-site scripting attacks in social network APIs", Proceedings of Workshop on WEB 2.0 Security and Privacy (W2SP 2013) (2013)
- I. Hydara, "Current state of research on cross-site scripting(XSS) : a systematic literature review", Information and Software Technology, 58, pp.170~186 (2015)
- M. K Gupta, "Static analysis approaches to detect SQL injection and cross site scripting vulnerabilities in web applications: a survey", Proceedings of the Recent Advances and Innovations in Engineering (ICRAIE), pp.1~5 (2014)
- Y. Cao, "Pathcutter: severing the self-propagation path of XSS JavaScript Worms in social web networks", Proceedings of the Network and Distributed System Security Symposium (NDSS’12), pp.1~14 (2012)
- "New Chinese social networking worm discovered" (2009)[URL]
- "Technical explanation of The MySpace Worm"[URL]
- "Cross-platform Boonana Trojan targets Facebook users" (2010)[URL]
- "XSS attack" (2016)[URL]
- P. Likarish, "Obfuscated malicious JavaScript detection using classification techniques", Proceedings of the 4th International Conference on Malicious and Unwanted Software (MALWARE), pp.47~54 (2009)
- A. E. Nunan, "Automatic classification of cross-site scripting in webpages using document-based and URL-based features", Proceedings of the IEEE Symposium on Computers and Communications (ISCC), pp.000702~000707 (2012)
- F. Sun, "Client-side detection of XSS worms by monitoring payload propagation", Proceedings of the 14th European Symposium on Research in Computer Security, pp.539~554 (2009)
- V. B. Livshits, "Spectator: detection and containment of JavaScript Worms", Proceedings of the USENIX Annual Technical Conference, pp.335~348 (2008)
- M. Ter Louw, "Blueprint: robust prevention of cross-site scripting attacks for existing browsers", Proceedings of the 2009 30th IEEE Symposium on Security and Privacy, pp.331~346 (2009)
- W. Xu, "Toward worm detection in online social networks", Proceedings of the 26th Annual Computer Security Applications Conference (ACSAC’10), pp.11~20 (2010)
- M. A. Ahmed, "Multiple-path testing for cross site scripting using genetic algorithms", Journal of Systems Architecture, 64, pp.50~62 (2016)
- C. H. Wang, "A new cross-site scripting detection mechanism integrated with HTML5 and CORS properties by using browser extensions", Proceedings of the 2016 International Computer Symposium (ICS), pp.264~269 (2016)
- "CAPEC-72: URL encoding" (2017)[URL]
- 황영섭, "Classifying Malicious Web Pages by Using an Adaptive Support Vector Machine", JIPS(Journal of Information Processing Systems), 9(3), pp.395~404 (2013), 한국정보처리학회[DOI]
- R. Wang, "Improved N-gram approach for cross-site scripting detection in online social network", Proceedings of the Science and Information Conference (SAI), pp.1206~1212 (2015)
- "XSS attacks information"[URL]
- "The top 500 sites on the web" (2017)[URL]
- "Introducing a powerful open source social networking engine"[URL]
- "Weka 3: data mining software in Java"[URL]
- K. M. Prabusankarlal, "Assessment of combined textural and morphological features for diagnosis of breast masses in ultrasound", Human-centric Computing and Information Sciences, 5(1), pp.1~17 (2015)
- Chantana Chantrapornchai, "Two Machine Learning Models for Mobile Phone Battery Discharge Rate Prediction Based on Usage Patterns", JIPS(Journal of Information Processing Systems), 12(3), pp.436~454 (2016), 한국정보처리학회
- J. H. Choi, "A comparative study on data mining classification techniques for military applications", Journal of Convergence, 7, pp.1~7 (2016)
- R. Wang, "Machine learning based cross-site scripting detection in online social network", Proceedings of the 2014 IEEE International Conference on High Performance Computing and Communications (HPSS), 2014 IEEE 6th International Symposium on Cyberspace Safety and Security (CSS), and 2014 IEEE 11th International Conference on Embedded Software and Systems (ICESS), pp.823~826 (2014)