On the automatic detection algorithm of Cross Site Scripting (XSS) with the non-stationary Bernoulli distribution

Cross Site Scripting (XSS) is a kind of injection attack triggered by the malicious scripts on the Web sites. If attackers successfully lead XSS, end users' Web browsing session can be hijacked and their personal information is often stolen by attackers. One of main reasons for XSS is the vulnerabilities on the Web applications. However, those vulnerabilities are often left to maintain continuous services. Therefore, establishing technology for automatic detection of XSS has been important in recent years. This paper proposes the automatic detection algorithm of XSS. The proposed algorithm utilizes probabilistic approach since the feature of end user's input on the Web application is hopefully normal, but sometimes attack (malicious). In terms of statistical decision theory, the proposed algorithm is obtained by the Bayes optimal prediction based on the non-stationary Bernoulli process. Finally, our approach is validated by the simulation experiments with various data of inputs of Web applications.