Detection of XSS Attacks with One Class SVM Using TF-IDF and Devising a Vectorized Vocabulary

Cross Site Scripting (XSS) attacks are one of the most serious security risks on web applications, in which attackers force victims to execute malicious scripts on a browser. By applying machine learning to detection methods, several researches have been conducted on methods to detect Reflected XSS attacks and Stored XSS attacks. This paper proposes a method to detect XSS attacks using TF-IDF vectorization and One Class SVM, a machine learning model for unsupervised anomaly detection. One Class SVM eliminates the need to include XSS attack data in training data, allowing effective detection even when data for new XSS attack techniques is not prepared enough. We conducted two experiments on the Kaggle XSS dataset by vectorizing the TF-IDF and comparing each result. The first type uses all the vocabulary on the dataset, and another uses only the vocabulary contained in XSS attacks from the dataset. Since One Class SVM can identify the characteristics of XSS attacks from vectorized data, the latter type achieves higher performance, with an accuracy of 0.993, precision of 0.987, recall of 1.000, and F-measure of 0.993. The contribution of this paper is that our proposed method is based on unsupervised learning, which means a large number of new XSS attack data for retraining the model is not required. XSS attack detection is realized with high accuracy compared to previous research based on supervised learning methods.