Abstract:We propose IGXSS, an XSS payload detection model based on inductive graph neural network for detecting XSS attacks targeting IoT devices. By transforming the XSS payload detection task into a node classification task, we leverage the strength of inductive graph neural network in learning sample features, enabling IGXSS to achieve a F1 score of 0.846 despite unbalanced sample distribution and without relying on external resources. To facilitate the management, Internet of Things (IoT) vendors usually apply remote ways such as HTTP services to uniformly manage IoT devices, leading to traditional web application vulnerabilities that also endanger the cloud interfaces of IoT, such as cross‐site scripting (XSS), code injection, and Remote Command/Code Execute (RCE). XSS is one of the most common web application attacks, which allows the attacker to obtain private user information or attack IoT devices and IoT cloud platforms. Most of the existing XSS payload detection models are based on machine learning or deep learning, which usually require a lot of external resources, such as pretrained word vectors, to achieve a better performance on unknown samples. But in the field of XSS payload detection, high‐quality vector representations of samples are often difficult to obtain. In addition, existing models all perform substantially worse when the distribution of XSS payloads and benign samples in the test dataset is extremely unbalanced (e.g., XSS payloads: benign samples = 1: 20). While in the real XSS attack scenario against IoT, an XSS payload is often hidden in a massive amount of normal user requests, indicating that these models are not practical. In response to the above issues, we propose an XSS payload detection model based on inductive graph neural networks, IGXSS (XSS payload detection model based on inductive GCN), to detect XSS payloads targeting IoT. Firstly, we treat the samples and words obtained from segmenting the samples as nodes and attach lines between them in order to form a graph. Then, we obtain the feature matrix of nodes and edges utilizing information between nodes only (instead of external resources such as pretrained word vectors). Finally, we feed the obtained feature matrix into a two‐layer GCN for training and validate the performance of models in several datasets with different sample distributions. Extensive experiments on the real datasets show that IGXSS performs better compared to other models under various sample distributions. In particular, when the sample distribution is extremely unbalanced, the recall and F1 score of IGXSS still reach 1.000 and 0.846, demonstrating that IGXSS is more robust and more suitable for practical scenarios.

Data augmentation-based conditional Wasserstein generative adversarial network-gradient penalty for XSS attack detection system

Black-box adversarial attacks on XSS attack detection model

XSS adversarial example attacks based on deep reinforcement learning

IGXSS: XSS payload detection model based on inductive GCN

GAXSS: Effective Payload Generation Method to Detect XSS Vulnerabilities Based on Genetic Algorithm

Structural Learning of Attack Vectors for Generating Mutated XSS Attacks

Securing web applications against XSS and SQLi attacks using a novel deep learning approach

Generative Adversarial Network (GAN)-Based Autonomous Penetration Testing for Web Applications

Swift Detection of XSS Attacks: Enhancing XSS Attack Detection by Leveraging Hybrid Semantic Embeddings and AI Techniques

Improving Android Malware Detection Through Data Augmentation Using Wasserstein Generative Adversarial Networks

TMG-GAN: Generative Adversarial Networks-Based Imbalanced Learning for Network Intrusion Detection

algoXSSF: Detection and analysis of cross-site request forgery (XSRF) and cross-site scripting (XSS) attacks via Machine learning algorithms

Data augmentation in fault diagnosis based on the Wasserstein generative adversarial network with gradient penalty

Detection of cross-site scripting (XSS) attacks using machine learning techniques: a review

Enhanced detection of imbalanced malicious network traffic with regularized Generative Adversarial Networks

HTTPSmell: A Deep Learning Approach on Malicious HTTP Traffic Detection via Data Augmentation and Label Refactoring

Ensemble Data Augmentation for Imbalanced Fault Diagnosis.

Automatic Web Security Unit Testing: XSS Vulnerability Detection

Cross-site scripting attack detection based on a modified convolution neural network

Enhancing Network Intrusion Detection Performance using Generative Adversarial Networks

ConvXSS: A deep learning-based smart ICT framework against code injection attacks for HTML5 web applications in sustainable smart city infrastructure