XSSD: A Cross-site Scripting Attack Dataset and its Evaluation

Cross-site Scripting (abbreviated as XSS) attacks are application level code injection attacks where a malicious user injects malicious scripts into the legitimate code of a Web application used by the victim. To defend against such attacks, a number of defense mechanisms have been proposed over the years. The evaluation of the efficiency and the accuracy of a defense mechanism requires the use of a suitable relevant dataset. The unavailability of such an XSS feature dataset is a bottleneck in conducting research. To overcome this problem, we propose a data preparation framework, the result of which is an XSS feature dataset, referred to as XSSD (XSS Dataset). The dataset preparation framework consists of three stages and four modules, all of which are essential to support extraction of several URL-based and script-based features. We evaluate the dataset we generate with the help of five benchmark classifiers, and validate classification results in terms of ROC.