Feature Engineering for Cross-Site Scripting (XSS) Detection: A Machine Learning-Based Approach

With the widespread use of the internet, web applications have received increasing attention from organizations, companies, and social media throughout the years. A Cross-Site Scripting attack, known as XSS, is among the most common attacks targeting websites and web applications. It is listed as a second web application security risk according to the Open Web Application Security Project (OWASP) Top 10. Identifying the most significant features in application traffic is crucial in machine learning to reduce complexity and improve generalization. In this paper, two sets of features are proposed. The first one is a comprehensive set of 176 features including the most important XSS-related features. These features are grouped into 21 categories. Hence generalization may provide the ability for contextual understanding. In this way, the classifier captures the contextual relationships between tags, events, URL attributes, JS events, and others, resulting in a more holistic view of the XSS payload. These two sets are tested on well-known machine algorithms including DT, SVM, Ada, RF, etc. that are widely used in XSS detection. The results show that the first set of features which contains 176 features, gives better results in most cases. However, in both sets, the RF achieves the best accuracy, precision, recall, and False Positive Rate (FPR) of 99.67%, 99.66%, 99.6%, and 0.25%.