Abstract:Modern web application development involves handling enormous amounts of sensitive and consequential data. Security is, therefore, a crucial component of developing web applications. A web application's security is concerned with safeguarding the data it processes. The web application framework must have safeguards to stop and find application vulnerabilities. Among all web application attacks, SQL injection and XSS attacks are common, which may lead to severe damage to Web application data or web functionalities. Currently, there are many solutions provided by various study for SQLi and XSS attack detection, but most of the work shown have used either SQL/XSS payload-based detection or HTTP request-based detection. Few solutions available can detect SQLi and XSS attacks, but these methods provide very high false positive rates, and the accuracy of these models can further be improved. We proposed a novel approach for securing web applications from both cross-site scripting attacks and SQL injection attacks using decoding and standardization of SQL and XSS payloads and HTTP requests and trained our model using hybrid deep learning networks in this paper. The proposed hybrid DL model combines the strengths of CNNs in extracting features from input data and LSTMs in capturing temporal dependencies in sequential data. The soundness of our approach lies in the use of deep learning techniques that can identify subtle patterns in the data that traditional machine learning-based methods might miss. We have created a testbed dataset of Normal and SQLi/XSS HTTP requests and evaluated the performance of our model on this dataset. We have also trained and evaluated the proposed model on the Benchmark dataset HTTP CSIC 2010 and another SQL/XSS payload dataset. The experimental findings show that our proposed approach effectively identifies these attacks with high accuracy and a low percentage of false positives. Additionally, our model performed better than traditional machine learning-based methods. This soundness approach can be applied to various network security applications such as intrusion detection systems and web application firewalls. Using our model, we achieved an accuracy of 99.84%, 99.23% and 99.77% on the SQL-XSS Payload dataset, Testbed dataset and HTTP CSIC 2010 dataset, respectively.

Black-box adversarial attacks on XSS attack detection model

B3: Backdoor Attacks Against Black-box Machine Learning Models

XSS adversarial example attacks based on deep reinforcement learning

Towards Efficient Data Free Blackbox Adversarial Attack

Data augmentation-based conditional Wasserstein generative adversarial network-gradient penalty for XSS attack detection system

Fuzzing-based hard-label black-box attacks against machine learning models

A Black-Box Attack Method against Machine-Learning-Based Anomaly Network Flow Detection Models

Structural Learning of Attack Vectors for Generating Mutated XSS Attacks

Securing web applications against XSS and SQLi attacks using a novel deep learning approach

Improving Query Efficiency of Black-box Adversarial Attack

Cross-site scripting attack detection based on a modified convolution neural network

Detection of cross-site scripting (XSS) attacks using machine learning techniques: a review

A Black-box NLP Classifier Attacker

Adaptive Random Testing for XSS Vulnerability

GAXSS: Effective Payload Generation Method to Detect XSS Vulnerabilities Based on Genetic Algorithm

Swift Detection of XSS Attacks: Enhancing XSS Attack Detection by Leveraging Hybrid Semantic Embeddings and AI Techniques

algoXSSF: Detection and analysis of cross-site request forgery (XSRF) and cross-site scripting (XSS) attacks via Machine learning algorithms

Enhancing Black-Box Attacks With Self-Supervised Features and Luminance-Aware Visual Model

HTTPSmell: A Deep Learning Approach on Malicious HTTP Traffic Detection via Data Augmentation and Label Refactoring

Towards Black-box Attacks on Deep Learning Apps

ConvXSS: A deep learning-based smart ICT framework against code injection attacks for HTML5 web applications in sustainable smart city infrastructure