Cross-Site Scripting Guardian: A Static XSS Detector Based on Data Stream Input-Output Association Mining

Chenghao Li,Yiding Wang,Cheng Huang,Changwei Miao

doi:10.3390/app10144740

Chenghao Li, Yiding Wang + Show 2 more

Open Access

https://doi.org/10.3390/app10144740

Copy DOI

Abstract

The largest number of cybersecurity attacks is on web applications, in which Cross-Site Scripting (XSS) is the most popular way. The code audit is the main method to avoid the damage of XSS at the source code level. However, there are numerous limits implementing manual audits and rule-based audit tools. In the age of big data, it is a new research field to assist the manual auditing through machine learning. In this paper, we propose a new way to audit the XSS vulnerability in PHP source code snippets based on a PHP code parsing tool and the machine learning algorithm. We analyzed the operation sequence of source code and built a model to acquire the information that is most closely related to the XSS attack in the data stream. The method proposed can significantly improve the recall rate of vulnerability samples. Compared with related audit methods, our method has high reusability and excellent performance. Our classification model achieved an F1 score of 0.92, a recall rate of 0.98 (vulnerable sample), and an area under curve (AUC) of 0.97 on the test dataset.

Highlights

With the rise of communication technology such as 5G technology, data transmission ability has been greatly improved and web technology has been more widely used
Due to the lack of security awareness and the around usage of Web Application Firewall (WAF) technology, it is common for developers to ignore the vulnerability on the source code level
Based on the OPCODE sequence of VLD output, we set up three groups of comparative experiments to measure the impact of triples on XSS vulnerability detection using different combinations of SOURCE, SOURCE+FILTER, and SOURCE+FILTER+SINK

Summary

Introduction

With the rise of communication technology such as 5G technology, data transmission ability has been greatly improved and web technology has been more widely used. Due to the lack of security awareness and the around usage of Web Application Firewall (WAF) technology, it is common for developers to ignore the vulnerability on the source code level. According to Web Applications vulnerabilities and threats statistics for 2019, 82% of the vulnerabilities are in application code, which indicates the vulnerability audit itself is not negligible [2]. XSS attacks are the preferred way for more hackers to exploit vulnerabilities. It is highly harmful, has a wide range of influence, and can be combined with other forms of attack, which indicates that the prevention of XSS attacks in Web applications is urgent. XSS is one of the most common approaches of attack in Web applications, and the corresponding defense measures should be further emphasized [8]

Objectives

Results

Conclusion