XSSPro: XSS Attack Detection Proxy to Defend Social Networking Platforms

Pooja Chaudhary; B. B. Gupta; Chang Choi; Kwok Tai Chui

doi:10.1007/978-3-030-66046-8_34

XSSPro: XSS Attack Detection Proxy to Defend Social Networking Platforms

Pooja Chaudhary, B. B. Gupta, Chang Choi, Kwok Tai Chui

Electronic Engineering and Computer Science

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution › peer-review

5 Citations (Scopus)

Abstract

Social Platforms transpired as the fascinating attack surface to explode multitude of cyber-attacks as it facilitates sharing of personal and professional information. XSS vulnerability exists approximately in 80% of the social platforms. Hence, this paper presents an approach, XSSPro, to defend social networking platforms against XSS attacks. XSSPro operates through isolating the JavaScript code in the external file and performs decoding operation. The context of each injected JS code is identified and then similar scripts are grouped together to optimize the performance of XSSPro. Finally, extracted scripts are matched against the XSS attack vector repository to detect XSS attack. If matched then it is refined by using XSS APIs, otherwise, the response is XSS free and sent to the user. Experimental results revealed that XSSPro achieved an accuracy of 0.99 and is effective against thwarting XSS attack triggered using new features of the built-in code language with low false alarm rate.

Original language	English
Title of host publication	Computational Data and Social Networks - 9th International Conference, CSoNet 2020, Proceedings
Editors	Sriram Chellappan, Kim-Kwang Raymond Choo, NhatHai Phan
Pages	411-422
Number of pages	12
DOIs	https://doi.org/10.1007/978-3-030-66046-8_34
Publication status	Published - 2020
Event	9th International Conference on Computational Data and Social Networks, CSoNet 2020 - Dallas, United States Duration: 11 Dec 2020 → 13 Dec 2020

Publication series

Name	Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)
Volume	12575 LNCS
ISSN (Print)	0302-9743
ISSN (Electronic)	1611-3349

Conference

Conference	9th International Conference on Computational Data and Social Networks, CSoNet 2020
Country/Territory	United States
City	Dallas
Period	11/12/20 → 13/12/20

Keywords

Code injection vulnerability
Cross site scripting (XSS)
Malicious JS code
Social networking platforms (SNPs)
XSS API

Access to Document

10.1007/978-3-030-66046-8_34

Cite this

Chaudhary, P., Gupta, B. B., Choi, C., & Chui, K. T. (2020). XSSPro: XSS Attack Detection Proxy to Defend Social Networking Platforms. In S. Chellappan, K.-K. R. Choo, & N. Phan (Eds.), Computational Data and Social Networks - 9th International Conference, CSoNet 2020, Proceedings (pp. 411-422). (Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics); Vol. 12575 LNCS). https://doi.org/10.1007/978-3-030-66046-8_34

Chaudhary, Pooja ; Gupta, B. B. ; Choi, Chang et al. / XSSPro : XSS Attack Detection Proxy to Defend Social Networking Platforms. Computational Data and Social Networks - 9th International Conference, CSoNet 2020, Proceedings. editor / Sriram Chellappan ; Kim-Kwang Raymond Choo ; NhatHai Phan. 2020. pp. 411-422 (Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)).

@inproceedings{b4e7db529cef4cb68a25c7b09e654905,

title = "XSSPro: XSS Attack Detection Proxy to Defend Social Networking Platforms",

abstract = "Social Platforms transpired as the fascinating attack surface to explode multitude of cyber-attacks as it facilitates sharing of personal and professional information. XSS vulnerability exists approximately in 80% of the social platforms. Hence, this paper presents an approach, XSSPro, to defend social networking platforms against XSS attacks. XSSPro operates through isolating the JavaScript code in the external file and performs decoding operation. The context of each injected JS code is identified and then similar scripts are grouped together to optimize the performance of XSSPro. Finally, extracted scripts are matched against the XSS attack vector repository to detect XSS attack. If matched then it is refined by using XSS APIs, otherwise, the response is XSS free and sent to the user. Experimental results revealed that XSSPro achieved an accuracy of 0.99 and is effective against thwarting XSS attack triggered using new features of the built-in code language with low false alarm rate.",

keywords = "Code injection vulnerability, Cross site scripting (XSS), Malicious JS code, Social networking platforms (SNPs), XSS API",

author = "Pooja Chaudhary and Gupta, {B. B.} and Chang Choi and Chui, {Kwok Tai}",

note = "Publisher Copyright: {\textcopyright} 2020, Springer Nature Switzerland AG.; 9th International Conference on Computational Data and Social Networks, CSoNet 2020 ; Conference date: 11-12-2020 Through 13-12-2020",

year = "2020",

doi = "10.1007/978-3-030-66046-8_34",

language = "English",

isbn = "9783030660451",

series = "Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)",

pages = "411--422",

editor = "Sriram Chellappan and Choo, {Kim-Kwang Raymond} and NhatHai Phan",

booktitle = "Computational Data and Social Networks - 9th International Conference, CSoNet 2020, Proceedings",

}

Chaudhary, P, Gupta, BB, Choi, C & Chui, KT 2020, XSSPro: XSS Attack Detection Proxy to Defend Social Networking Platforms. in S Chellappan, K-KR Choo & N Phan (eds), Computational Data and Social Networks - 9th International Conference, CSoNet 2020, Proceedings. Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics), vol. 12575 LNCS, pp. 411-422, 9th International Conference on Computational Data and Social Networks, CSoNet 2020, Dallas, United States, 11/12/20. https://doi.org/10.1007/978-3-030-66046-8_34

XSSPro: XSS Attack Detection Proxy to Defend Social Networking Platforms. / Chaudhary, Pooja; Gupta, B. B.; Choi, Chang et al.
Computational Data and Social Networks - 9th International Conference, CSoNet 2020, Proceedings. ed. / Sriram Chellappan; Kim-Kwang Raymond Choo; NhatHai Phan. 2020. p. 411-422 (Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics); Vol. 12575 LNCS).

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution › peer-review

TY - GEN

T1 - XSSPro

T2 - 9th International Conference on Computational Data and Social Networks, CSoNet 2020

AU - Chaudhary, Pooja

AU - Gupta, B. B.

AU - Choi, Chang

AU - Chui, Kwok Tai

PY - 2020

Y1 - 2020

N2 - Social Platforms transpired as the fascinating attack surface to explode multitude of cyber-attacks as it facilitates sharing of personal and professional information. XSS vulnerability exists approximately in 80% of the social platforms. Hence, this paper presents an approach, XSSPro, to defend social networking platforms against XSS attacks. XSSPro operates through isolating the JavaScript code in the external file and performs decoding operation. The context of each injected JS code is identified and then similar scripts are grouped together to optimize the performance of XSSPro. Finally, extracted scripts are matched against the XSS attack vector repository to detect XSS attack. If matched then it is refined by using XSS APIs, otherwise, the response is XSS free and sent to the user. Experimental results revealed that XSSPro achieved an accuracy of 0.99 and is effective against thwarting XSS attack triggered using new features of the built-in code language with low false alarm rate.

AB - Social Platforms transpired as the fascinating attack surface to explode multitude of cyber-attacks as it facilitates sharing of personal and professional information. XSS vulnerability exists approximately in 80% of the social platforms. Hence, this paper presents an approach, XSSPro, to defend social networking platforms against XSS attacks. XSSPro operates through isolating the JavaScript code in the external file and performs decoding operation. The context of each injected JS code is identified and then similar scripts are grouped together to optimize the performance of XSSPro. Finally, extracted scripts are matched against the XSS attack vector repository to detect XSS attack. If matched then it is refined by using XSS APIs, otherwise, the response is XSS free and sent to the user. Experimental results revealed that XSSPro achieved an accuracy of 0.99 and is effective against thwarting XSS attack triggered using new features of the built-in code language with low false alarm rate.

KW - Code injection vulnerability

KW - Cross site scripting (XSS)

KW - Malicious JS code

KW - Social networking platforms (SNPs)

KW - XSS API

UR - http://www.scopus.com/inward/record.url?scp=85101370166&partnerID=8YFLogxK

U2 - 10.1007/978-3-030-66046-8_34

DO - 10.1007/978-3-030-66046-8_34

M3 - Conference contribution

AN - SCOPUS:85101370166

SN - 9783030660451

T3 - Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)

SP - 411

EP - 422

BT - Computational Data and Social Networks - 9th International Conference, CSoNet 2020, Proceedings

A2 - Chellappan, Sriram

A2 - Choo, Kim-Kwang Raymond

A2 - Phan, NhatHai

Y2 - 11 December 2020 through 13 December 2020

ER -

Chaudhary P, Gupta BB, Choi C, Chui KT. XSSPro: XSS Attack Detection Proxy to Defend Social Networking Platforms. In Chellappan S, Choo KKR, Phan N, editors, Computational Data and Social Networks - 9th International Conference, CSoNet 2020, Proceedings. 2020. p. 411-422. (Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)). doi: 10.1007/978-3-030-66046-8_34

XSSPro: XSS Attack Detection Proxy to Defend Social Networking Platforms

Abstract

Publication series

Conference

Keywords

Access to Document

Other files and links

Fingerprint

Cite this