BiLSTM在跨站脚本检测中的应用研究

Application Research of BiLSTM in Cross-Site Scripting Detection

目前传统的跨站脚本(XSS)检测技术大多使用机器学习方法,存在代码被恶意混淆导致可读性不高、特征提取不充分并且效率低等缺陷,从而导致检测性能不佳。针对上述问题,提出了使用双向长短时记忆网络检测跨站脚本攻击的方法。首先,对数据进行预处理,使用解码技术将跨站脚本代码还原到未编码状态,从而提高跨站脚本代码的可读性,再使用深度学习工具word2vec将解码后的代码转换为向量作为神经网络的输入;其次,使用双向长短时记忆网络双向学习跨站脚本攻击的抽象特征;最后,使用softmax分类器对学习到的抽象特征进行分类,同时使用dropout算法避免模型出现过拟合。对收集到的数据集进行实验,结果表明,与几种传统机器学习方法和深度学习方法相比,该检测方法表现出更优的检测性能。

At present,machine learning methods are used in the most traditional cross-site scripting(XSS)detection technologies,which have some defects,such as bad readability because of maliciously confused code,insufficient feature extraction and low efficiency,resulting in poor performance.According to these problems,a way used bidirectional long-short term memory(BiLSTM)network is proposed to detect the XSS attack.First,the data need to be preprocessed,the decoding technology is used to restore the XSS codes to the state before encoding to improve the readability,and the deep learning tool word2vec is used to convert the decoded codes into vectors as the input of the neural network.Then,BiLSTM network is used to bilaterally learn the abstract features of the attack.Finally,the softmax classifier is used to classify the learned abstract features and the dropout algorithm is used to avoid over fitting.The experimental results based on the collected datasets show that compared with several traditional machine learning methods and deep learning methods,this method has better detection performance.