A PU-learning based approach for cross-site scripting attacking reality detection

Cross-site scripting (XSS) attack has been one of the most dangerous attacks in cyberspace security. Traditional methods essentially discover XSS attack by detecting malicious payloads in requests, which is unable to distinguish attacking attempts with the attacking reality. The authors collect responses from a web server and train a bagging-based PU learning model to determine whether the XSS vulnerability is truly triggered. To validate the authors’ proposed framework, experiments are performed on 5 popular web applications with 11 specified CVE recorded vulnerabilities and 32 vulnerable inputs. Results show that the authors’ approach outperforms existing research studies, effectively identifies the attacking reality from attacking attempts, and meanwhile reduces the number of worthless security alarms.