An Analysis of Machine-Learning Feature-Extraction Techniques using Syntactic Tagging for Cross-site Scripting Detection
0
조회
0
다운로드
0
인용
0
참고문헌
키워드
초록
Working for a strategy to ensure web application security has become more complex as it is not only to protect against the more challenging cross-site scripting (XSS) attacks but also to assist the open expressiveness of web applications to provide users with interactive services. The feature extractions used in supervised machine learning to detect XSS as an approach to the strategy are now in question of their effective classification. Their lack of preserving structural information may not uphold the property of structured data in input payloads. We apply the concept of syntactic n-grams to a payload text representation. The study of different feature extractions on the representation is to see if syntactic information is maintained. Our purpose is to determine the more effective approach to correctly classify benign and malicious payloads on a real-world dataset. The use of sn-grams that produces the most favourable results of accuracy and precision would only indicate that the extraction is reasonably able to minimize false reports during classification.
Abstract
Working for a strategy to ensure web application security has become more complex as it is not only to protect against the more challenging cross-site scripting (XSS) attacks but also to assist the open expressiveness of web applications to provide users with interactive services. The feature extractions used in supervised machine learning to detect XSS as an approach to the strategy are now in question of their effective classification. Their lack of preserving structural information may not uphold the property of structured data in input payloads. We apply the concept of syntactic n-grams to a payload text representation. The study of different feature extractions on the representation is to see if syntactic information is maintained. Our purpose is to determine the more effective approach to correctly classify benign and malicious payloads on a real-world dataset. The use of sn-grams that produces the most favourable results of accuracy and precision would only indicate that the extraction is reasonably able to minimize false reports during classification.
참고문헌 (17)
- "OWASP Top 10:2021" (2021)[URL]
- "CVE Details: The Ultimate Security Vulnerability Datasource"[URL]
- Giovanni Apruzzese, "On the effectiveness of machine and deep learning for cyber security", 2018 10th International Conference on Cyber Conflict (CyCon), 2018(5), pp.371~389 (2018), IEEE
- Angelo Eduardo Nunan, "Automatic classification of cross-site scripting in web pages using document-based and URL-based features", 2012 IEEE Symposium on Computers and Communications (ISCC), pp.000702~000707 (2012), IEEE
- Shailendra Rathore, "XSSClassifier: An Efficient XSS Attack Detection Approach Based on Machine Learning Classifier on SNSs", JIPS(Journal of Information Processing Systems), 13(4), pp.1014~1028 (2017), 한국정보처리학회[DOI]
- Samuel Ndichu, "A machine learning approach to detection of JavaScript-based attacks using AST features and paragraph vectors", Applied Soft Computing, 84, pp.105721~ (2019), Elsevier BV[DOI]
- A. C. Müller, "Introduction to Machine Learning with Python: a guide for data scientists", 53(9) (2016)
- N. A. Abu Talib, "Run-time Detection of Cross-site Scripting: A Machine-Learning Approach Using Syntactic-Tagging N-Gram Features"
- Grigori Sidorov, "Syntactic N-grams as machine learning features for natural language processing", Expert Systems with Applications, 41(3), pp.853~860 (2014), Elsevier BV[DOI]
- T. Mikolov, "Efficient estimation of word representations in vector space", 1st Int. Conf. Learn. Represent. ICLR 2013 - Work. Track Proc (2013)
- Q. Le, "Distributed representations of sentences and documents", 31st Int. Conf. Mach. Learn. ICML 2014, 4, pp.2931~2939 (2014)
- Y. Fang, "DeepXSS: Cross site scripting detection based on deep learning", ACM Int. Conf. Proceeding Ser., pp.47~51 (2018)
- Fawaz A. Mereani, "Detecting Cross-Site Scripting Attacks Using Machine Learning", The International Conference on Advanced Machine Learning Technologies and Applications (AMLTA2018), 723, pp.200~210 (2018), Springer International Publishing[DOI]
- Apeksha Khabia, "A Cluster based Approach with N-grams at Word Level for Document Classification", International Journal of Computer Applications, 117(23), pp.38~42 (2015), Foundation of Computer Science[DOI]
- Boris Chernis, "Machine learning methods for software vulnerability detection", IWSPA 2018 - Proc. 4th ACM Int. Work. Secur. Priv. Anal. Co-located with CODASPY 2018, 2018(1), pp.31~39 (2018)
- Maede Zolanvari, "Machine Learning-Based Network Vulnerability Analysis of Industrial Internet of Things", IEEE Internet of Things Journal, 6(4), pp.6822~6834 (2019), Institute of Electrical and Electronics Engineers (IEEE)[DOI]
- Debabrata Kar, "SQLiDDS: SQL Injection Detection Using Query Transformation and Document Similarity", Distributed Computing and Internet Technology, 8956, pp.377~390 (2015), Springer International Publishing[DOI]