Cross-Site Scripting(XSS)remains a significant threat to web application security,exploiting vulnerabilities to hijack user sessions and steal sensitive data.Traditional detection methods often fail to keep pace with ...Cross-Site Scripting(XSS)remains a significant threat to web application security,exploiting vulnerabilities to hijack user sessions and steal sensitive data.Traditional detection methods often fail to keep pace with the evolving sophistication of cyber threats.This paper introduces a novel hybrid ensemble learning framework that leverages a combination of advanced machine learning algorithms—Logistic Regression(LR),Support Vector Machines(SVM),eXtreme Gradient Boosting(XGBoost),Categorical Boosting(CatBoost),and Deep Neural Networks(DNN).Utilizing the XSS-Attacks-2021 dataset,which comprises 460 instances across various real-world trafficrelated scenarios,this framework significantly enhances XSS attack detection.Our approach,which includes rigorous feature engineering and model tuning,not only optimizes accuracy but also effectively minimizes false positives(FP)(0.13%)and false negatives(FN)(0.19%).This comprehensive methodology has been rigorously validated,achieving an unprecedented accuracy of 99.87%.The proposed system is scalable and efficient,capable of adapting to the increasing number of web applications and user demands without a decline in performance.It demonstrates exceptional real-time capabilities,with the ability to detect XSS attacks dynamically,maintaining high accuracy and low latency even under significant loads.Furthermore,despite the computational complexity introduced by the hybrid ensemble approach,strategic use of parallel processing and algorithm tuning ensures that the system remains scalable and performs robustly in real-time applications.Designed for easy integration with existing web security systems,our framework supports adaptable Application Programming Interfaces(APIs)and a modular design,facilitating seamless augmentation of current defenses.This innovation represents a significant advancement in cybersecurity,offering a scalable and effective solution for securing modern web applications against evolving threats.展开更多
Considering the escalating frequency and sophistication of cyber threats targeting web applications, this paper proposes the development of an automated web security analysis tool to address the accessibility gap for ...Considering the escalating frequency and sophistication of cyber threats targeting web applications, this paper proposes the development of an automated web security analysis tool to address the accessibility gap for non-security professionals. This paper presents the design and implementation of an automated web security analysis tool, AWSAT, aimed at enabling individuals with limited security expertise to effectively assess and mitigate vulnerabilities in web applications. Leveraging advanced scanning techniques, the tool identifies common threats such as Cross-Site Scripting (XSS), SQL Injection, and Cross-Site Request Forgery (CSRF), providing detailed reports with actionable insights. By integrating sample payloads and reference study links, the tool facilitates informed decision-making in enhancing the security posture of web applications. Through its user-friendly interface and robust functionality, the tool aims to democratize web security practices, empowering a wider audience to proactively safeguard against cyber threats.展开更多
XSS(Cross Site Scripting)攻击是目前最流行的WEB攻击方式之一,随着对XSS攻击的防护提升,XSS攻击的变种也逐渐增多,最终目的为绕过防护系统进行攻击。针对上述问题,制定新的过滤规则,并基于过滤规则建立XSS过滤模型,规则的制定是基于...XSS(Cross Site Scripting)攻击是目前最流行的WEB攻击方式之一,随着对XSS攻击的防护提升,XSS攻击的变种也逐渐增多,最终目的为绕过防护系统进行攻击。针对上述问题,制定新的过滤规则,并基于过滤规则建立XSS过滤模型,规则的制定是基于可控的XSS敏感字符库来实现的。反绕过的最终实现形式为XSS过滤模型的建立,将该过滤模型集成到WEB项目中,对可能出现漏检或绕过的字符进行收集并列入敏感字符库中,应对XSS绕过攻击。实验表明,该过滤模型能够有效地应对XSS绕过攻击,并降低系统安全维护难度,同时能够有效应对未知的XSS攻击。展开更多
XSS,即跨站脚本攻击(Cross Site Script)是Web程序中最常见的漏洞之一,针对XSS攻击众多学者也提出了许多检测与防御方法。文中试着从一个新的角度,借助HTML5的一些新特性,提出一套纯前端脚本实现的在线预警系统,在可疑XSS攻击发生时能...XSS,即跨站脚本攻击(Cross Site Script)是Web程序中最常见的漏洞之一,针对XSS攻击众多学者也提出了许多检测与防御方法。文中试着从一个新的角度,借助HTML5的一些新特性,提出一套纯前端脚本实现的在线预警系统,在可疑XSS攻击发生时能及时修复漏洞。在文章最后,还将该系统与HTML5自身的XSS解决方案CSP(Content Security Policy)进行对比,分析其优劣。展开更多
随着信息时代的到来,网络安全问题越来越受到人们关注,其中Web安全问题是最常见的安全问题。文章根据风险的发生频率和危害程度,以结构化查询语言(Structured Query Language,SQL)注入、跨站脚本攻击(Cross Site Scripting,XSS)注入、...随着信息时代的到来,网络安全问题越来越受到人们关注,其中Web安全问题是最常见的安全问题。文章根据风险的发生频率和危害程度,以结构化查询语言(Structured Query Language,SQL)注入、跨站脚本攻击(Cross Site Scripting,XSS)注入、文件上传漏洞为例,研究这3种安全风险的原理、分类及安全防护。展开更多
基金supported by Princess Nourah bint Abdulrahman University Researchers Supporting Project number(PNURSP2024R513),Princess Nourah bint Abdulrahman University,Riyadh,Saudi Arabia.
文摘Cross-Site Scripting(XSS)remains a significant threat to web application security,exploiting vulnerabilities to hijack user sessions and steal sensitive data.Traditional detection methods often fail to keep pace with the evolving sophistication of cyber threats.This paper introduces a novel hybrid ensemble learning framework that leverages a combination of advanced machine learning algorithms—Logistic Regression(LR),Support Vector Machines(SVM),eXtreme Gradient Boosting(XGBoost),Categorical Boosting(CatBoost),and Deep Neural Networks(DNN).Utilizing the XSS-Attacks-2021 dataset,which comprises 460 instances across various real-world trafficrelated scenarios,this framework significantly enhances XSS attack detection.Our approach,which includes rigorous feature engineering and model tuning,not only optimizes accuracy but also effectively minimizes false positives(FP)(0.13%)and false negatives(FN)(0.19%).This comprehensive methodology has been rigorously validated,achieving an unprecedented accuracy of 99.87%.The proposed system is scalable and efficient,capable of adapting to the increasing number of web applications and user demands without a decline in performance.It demonstrates exceptional real-time capabilities,with the ability to detect XSS attacks dynamically,maintaining high accuracy and low latency even under significant loads.Furthermore,despite the computational complexity introduced by the hybrid ensemble approach,strategic use of parallel processing and algorithm tuning ensures that the system remains scalable and performs robustly in real-time applications.Designed for easy integration with existing web security systems,our framework supports adaptable Application Programming Interfaces(APIs)and a modular design,facilitating seamless augmentation of current defenses.This innovation represents a significant advancement in cybersecurity,offering a scalable and effective solution for securing modern web applications against evolving threats.
文摘Considering the escalating frequency and sophistication of cyber threats targeting web applications, this paper proposes the development of an automated web security analysis tool to address the accessibility gap for non-security professionals. This paper presents the design and implementation of an automated web security analysis tool, AWSAT, aimed at enabling individuals with limited security expertise to effectively assess and mitigate vulnerabilities in web applications. Leveraging advanced scanning techniques, the tool identifies common threats such as Cross-Site Scripting (XSS), SQL Injection, and Cross-Site Request Forgery (CSRF), providing detailed reports with actionable insights. By integrating sample payloads and reference study links, the tool facilitates informed decision-making in enhancing the security posture of web applications. Through its user-friendly interface and robust functionality, the tool aims to democratize web security practices, empowering a wider audience to proactively safeguard against cyber threats.
文摘XSS(Cross Site Scripting)攻击是目前最流行的WEB攻击方式之一,随着对XSS攻击的防护提升,XSS攻击的变种也逐渐增多,最终目的为绕过防护系统进行攻击。针对上述问题,制定新的过滤规则,并基于过滤规则建立XSS过滤模型,规则的制定是基于可控的XSS敏感字符库来实现的。反绕过的最终实现形式为XSS过滤模型的建立,将该过滤模型集成到WEB项目中,对可能出现漏检或绕过的字符进行收集并列入敏感字符库中,应对XSS绕过攻击。实验表明,该过滤模型能够有效地应对XSS绕过攻击,并降低系统安全维护难度,同时能够有效应对未知的XSS攻击。
文摘XSS,即跨站脚本攻击(Cross Site Script)是Web程序中最常见的漏洞之一,针对XSS攻击众多学者也提出了许多检测与防御方法。文中试着从一个新的角度,借助HTML5的一些新特性,提出一套纯前端脚本实现的在线预警系统,在可疑XSS攻击发生时能及时修复漏洞。在文章最后,还将该系统与HTML5自身的XSS解决方案CSP(Content Security Policy)进行对比,分析其优劣。
文摘随着信息时代的到来,网络安全问题越来越受到人们关注,其中Web安全问题是最常见的安全问题。文章根据风险的发生频率和危害程度,以结构化查询语言(Structured Query Language,SQL)注入、跨站脚本攻击(Cross Site Scripting,XSS)注入、文件上传漏洞为例,研究这3种安全风险的原理、分类及安全防护。
