MNN-XSS: Modular Neural Network Based Approach for XSS Attack Detection

Alqarni, Ahmed Abdullah; Alsharif, Nizar; Khan, Nayeem Ahmad; Georgieva, Lilia; Pardade, Eric; Alzahrani, Mohammed

doi:10.32604/cmc.2022.020389

Cited by 11 publications

(5 citation statements)

References 22 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Cross-Site Scripting: Cross-Site Scripting (XSS) [170] is an attack where a malicious actor injects harmful code into a web application or browser, and this code is then executed on the client side [171].The primary objective of this attack is to hijack a user's session by stealing session tokens and cookies [172]- [176].…”

Section: Security Concerns In Web Applications and Browsersmentioning

confidence: 99%

Performance, privacy, and security issues of TCP/IP at the application layer: A comprehensive survey

Timothy Murkomen

2024

GSC Adv. Res. Rev.

View full text Add to dashboard Cite

TCP/IP is the backbone of modern network communication, connecting devices across the world. TCP/IP at its core is a suite of protocols that enables the transmission of data between computers, facilitating the foundation of the interconnected global network. At the Application Layer of TCP/IP is where the interaction between software applications and the network occurs. The user-centric protocols such as HTTP, SMTP, FTP, POP3, IMAP and DNS facilitate various tasks at this layer such as web browsing, email communication, and file transfer. This comprehensive survey conducted an exploration of the performance, security and privacy issues at the application layer of the TCP/IP. It initiated by providing a background of TCP/IP model, it’s architecture and the core characteristics, with major focus on the application layer. This paper aimed to discuss the state-of-the-art of performance, privacy and security concerns in TCP/IP application layer. It also proposed future research areas to equip researchers, practitioners, policy makers and the decision makers with tangible knowledge, offering guidance in navigating the performance, privacy and security concerns in TCP/IP Application Layer. It aimed to discuss the current performance, privacy and security research gaps at the Application Layer of the TCP/IP Model. The findings of this research sheds light on the performance, privacy and security issues while suggesting the countermeasures to strengthen and optimize the overall performance, security and privacy of TCP/IP model at the application layer. The paper finally suggests future directions and research areas at the TCP/IP application layer.

show abstract

Section: Security Concerns In Web Applications and Browsersmentioning

confidence: 99%

Performance, privacy, and security issues of TCP/IP at the application layer: A comprehensive survey

Timothy Murkomen

2024

GSC Adv. Res. Rev.

View full text Add to dashboard Cite

show abstract

“…Table 2 presents a comprehensive overview of the comparison between processing methods across three aspects, with rankings indicating the level of fulfillment for each aspect. The following three aspects were measured in this comparative analysis: [13] String (word) ✓ Doc2Vec [14], SVM [15] Alex et al [16] Static features ✓ DBN [17], Swam algorithm [18] Alqarni et al [19] Static features ✓ Word2Vec [20], LSTM [21] Liang et al [22] Static features ✓ Tree-CNN [23] Shen et al [24] Static features ✓ High-Level Fuzzy Petri Net [25] Alazab et al [26] Static features ✓ SVM He et al [27] Static features ✓ MJDetector Wang et al [28] Static features 1) Flexibility: the given method's ability to capture a wider range of malicious cases. 2) Semantic meaning: the given method's ability to represent the semantic meaning of code.…”

Section: Related Workmentioning

confidence: 99%

“…Alex et al [16] proposed a deep learning-based detection method that utilizes features such as Boolean values, execution time, function calls, break statements, and conditional statements. Alqarni et al [19] particularly targeted JavaScript functions commonly found in malicious code by employing long shortterm memory (LSTM) to capture feature patterns. Similar efforts have utilized deep learning models, such as Tree-CNN [22], high-level fuzzy Petri nets [24], and MJDetector [27].…”

Section: A Feature Engineering-based Approachesmentioning

confidence: 99%

Detecting Malicious JavaScript Using Structure-Based Analysis of Graph Representation

Rozi,

Ban,

Ozawa

et al. 2023

IEEE Access

View full text Add to dashboard Cite

Malicious JavaScript code in web applications poses a significant threat as cyber attackers exploit it to perform various malicious activities. Detecting these malicious scripts is challenging, given their diverse nature and the continuous evolution of attack techniques. Most approaches formulate this task as a static or sequential feature of the script, which is insufficient in terms of flexibility to various attack techniques and the ability to capture the script's semantic meaning. To address this issue, we propose an alternative approach that leverages JavaScript code's abstract syntax tree (AST) representation, focusing on distinctive syntactic structure features. The proposed approach uses graph neural networks to extract structural features from the AST graph while considering the attribute features of individual nodes, which uses neural message passing with neighborhood aggregation. The proposed method encodes both the local AST graph structure and attributes of the nodes. It enables capturing the source code's semantic meaning and exploits the signature structure in the AST representations. The proposed method consistently achieved high detection performance in extensive experiments on two different datasets, with accuracy scores of 99.4% and 96.92%. The obtained evaluation metrics demonstrate the effectiveness of our approach in accurately detecting malicious JavaScript code, with our proposed method successfully detecting more than 81% for various attack types and achieving an almost twofold performance improvement on JS-Droppers compared to the sequence-based approach. In addition, we observed that the AST graph structure represented the code's semantic meaning, exhibiting distinctive patterns and signatures that could be effectively captured using the proposed method.

show abstract

“…Furthermore, their unique configuration, including the open state of the connected sensors, wireless network, and so on, are very vulnerable to technological systems. In recent years, studies have been conducted to investigate cyber security risks to UAVs that are utilized in the military sector [8][9][10][11]. However, little research has been conducted to investigate whether extra cyber hazards exist for the usage of commercially accessible UAVs.…”

Section: Introductionmentioning

confidence: 99%

Protecting Attacks on Unmanned Aerial Vehicles using Homomorphic Encryption

Alzahrani

Khan

Georgieva

et al. 2023

IJEEI

View full text Add to dashboard Cite

With the exponential growth in the usage of unmanned aerial vehicles (UAV), often known as drones, for military, civilian, and recreational purposes. Security of internal communication modules and communication to the ground control station is considered the foremost challenge. Hacking into the system and attacking the internal communication devices with malicious code can disaster the vehicle's system. The need for having a secure communication channel between the internal modules of the vehicle and transmission of data to the ground control station is of utmost crucial. Existing mechanisms based on conventional encryption methods are highly suspectable to attacks as their keys can be broken by employing high computing power. Another challenge with these approaches is undesired high-level data communication latency affecting real-time communication. This study implements a homographic encryption-based technique for secure communication. In addition, we also propose a key regeneration algorithm based on pallier homomorphic encryption. Simulations were conducted using OMNET++ and Aerial Vehicle Network Simulator (AVENS). In this study 54 encryption attacks were collected from different sources. Compared to Digital Encryption Standard (DES) and Advanced Digital Encryption (AES), the proposed approach defended all the communication attacks between the UAV and the ground control station.

show abstract

MNN-XSS: Modular Neural Network Based Approach for XSS Attack Detection

Cited by 11 publications

References 22 publications

Performance, privacy, and security issues of TCP/IP at the application layer: A comprehensive survey

Performance, privacy, and security issues of TCP/IP at the application layer: A comprehensive survey

Detecting Malicious JavaScript Using Structure-Based Analysis of Graph Representation

Protecting Attacks on Unmanned Aerial Vehicles using Homomorphic Encryption

Contact Info

Product

Resources

About