Intelligent detection method for detecting cross-site scripting attack

Abstract

The invention discloses an intelligent detection method for detecting cross-site scripting attacks, and relates to the field of network security, in particular to the intelligent detection method for detecting the cross-site scripting attacks. The invention aims to solve the problems that an existing detection method ignores a structural dependency relationship in an attack carrier, so that the feature extraction capability is limited; a modeling capability for deep interaction between different modals is lacked, complex association between the modals cannot be fully captured, and the discrimination capability of a detection model is limited; and the problem that the final classification performance is affected due to inconsistent feature representation after fusion caused by the fact that a unified representation space is not constructed is solved. The method comprises the following steps: 1, acquiring an XSS attack sample and a normal traffic sample; the XSS is a cross-site script; 2, obtaining a cleaned XSS attack sample and a normal traffic sample; 3, constructing an XSS attack detection core vocabulary; 4, obtaining a trained XSS attack detection model; and 5, outputting whether the XSS to be tested is an attack sample or a normal traffic sample.

Description

Technical Field

[0001] The present invention relates to the field of network security, and particularly to an intelligent detection method for detecting cross-site scripting attacks. Background Art

[0002] Cross-site scripting (XSS) attacks are a widespread network security threat. Attackers exploit vulnerabilities in web page input and output processing to embed malicious scripts into web pages. When a user accesses a web page containing malicious scripts, the malicious code will be executed on the user's browser side, which may lead to user data leakage, user session hijacking, page tampering, or other malicious operations. To combat XSS attacks, the industry has proposed a variety of detection and defense technologies, including content security policies (CSP), automated static and dynamic analysis, web application firewalls (WAF), and intelligent detection methods based on machine learning and deep learning that have developed rapidly in recent years.

[0003] Currently, mainstream XSS attack detection methods mainly rely on multi-feature fusion technologies to integrate information from different sources to improve detection effectiveness. Compared with traditional methods, such technologies alleviate the dependence on a single feature to a certain extent, improve the ability to analyze dynamic contexts, and enhance the adaptability to unknown attack samples. However, existing methods still have several limitations:

[0004] Insufficient structural relationship modeling: Existing detection methods usually focus on text content features and context semantic features, while ignoring the structural dependency relationships within the attack carrier, such as the syntactic associations between different words or HTML elements, the propagation paths of XSS attack codes, etc., resulting in limited feature extraction capabilities.

[0005] Limited ability to model interactions between modalities: Mainstream methods usually integrate multi-modal features (such as text, structure, context, etc.) using simple concatenation or linear fusion methods, but lack the ability to model the deep interactions between different modalities, unable to fully capture the complex associations between modalities, and restricting the discriminative ability of the detection model.

[0006] Feature fusion space separation: Existing multi-modal detection methods usually process different types of features in their respective independent feature spaces, rather than constructing a unified representation space to project and fuse multi-modal features, resulting in inconsistent feature representations after fusion and affecting the final classification performance. Summary of the Invention

[0007] The object of the present invention is to solve the problems that existing detection methods ignore the structural dependencies inside the attack vectors, resulting in limited feature extraction capabilities; lack the ability to model the deep interactions between different modalities, unable to fully capture the complex correlations between modalities, restricting the discriminative ability of the detection model; and fail to construct a unified representation space, leading to inconsistent feature representations after fusion and affecting the final classification performance, and to propose an intelligent detection method for detecting cross-site scripting attacks.

[0008] The specific process of an intelligent detection method for detecting cross-site scripting attacks is as follows:

[0009] Step 1: Obtain XSS attack samples and normal traffic samples, and use the XSS attack samples and normal traffic samples as the training set;

[0010] XSS stands for cross-site scripting;

[0011] Step 2: Clean the XSS attack samples and normal traffic samples obtained in Step 1 to obtain the cleaned XSS attack samples and normal traffic samples;

[0012] Step 3: Segment the cleaned XSS attack samples and normal traffic samples obtained in Step 2 to obtain words;

[0013] Calculate the term frequency-inverse document frequency value of each word;

[0014] Select the top N words with the highest term frequency-inverse document frequency values to construct the core vocabulary for XSS attack detection;

[0015] Step 4: Construct an XSS attack detection model and obtain a trained XSS attack detection model based on the core vocabulary for XSS attack detection;

[0016] Step 5: Input the XSS sample to be tested into the trained XSS attack detection model, and the trained XSS attack detection model outputs whether the XSS sample to be tested is an attack sample or a normal traffic sample.

[0017] The beneficial effects of the present invention are as follows:

[0018] An intelligent detection method for detecting cross-site scripting (Cross-Site Scripting, XSS) attacks according to the present invention constructs a shared spatiotemporal feature projection mechanism based on the Shared Spatiotemporal Feature Projection Fusion (SSFPF) technology, realizes the unified representation of multi-modal features, and fully excavates the deep correlations between modalities, improving the accuracy and robustness of XSS detection.

[0019] Global and Local Feature Fusion: Based on capturing text, structural, and contextual features, the present invention further introduces a spatio-temporal feature projection mechanism to map information of different modalities into a shared feature space, thereby enhancing the fusion effect.

[0020] Enhanced Feature Interaction Modeling: The attention mechanism is adopted to optimize the information interaction between modalities, enhance the correlation of features of different modalities, and improve the adaptability of the detection model to complex XSS attack samples.

[0021] Improve Classification Performance: Based on shared feature projection, ensure the consistency of the fused feature representations, thereby improving the final detection performance and reducing false positives and false negatives.

[0022] The present invention provides a more intelligent, efficient, and robust XSS attack detection solution, which can be widely applied in fields such as Web security protection, intrusion detection systems (IDS), and malicious code analysis.

[0023] An intelligent detection method for detecting Cross-Site Scripting (XSS) attacks according to the present invention, based on the Shared Spatiotemporal Feature Projection Fusion (SSFPF) technology, to improve the accuracy and robustness of XSS attack detection.

[0024] The present invention proposes an efficient and robust XSS attack detection method, the core technologies of which include XSS temporal feature extraction, XSS spatial structure feature extraction, and multi-feature fusion. Specifically, the innovation of the present invention is reflected in the following three aspects:

[0025] (1) XSS Temporal Feature Extraction:

[0026] To deeply excavate the temporal information of XSS attack codes, the present invention proposes a bidirectional long short-term memory (Bi-LSTM) network embedded with a position-aware self-attention mechanism. This method combines Bi-LSTM with a position-aware self-attention model, which can obtain deeper information representations in the bidirectional temporal context and dynamically adjust the attention to different temporal elements to improve the ability to capture key features. In addition, the present invention designs a dynamic weight calculation mechanism, combined with the position-aware self-attention model, to assign variable weights to the features of different time steps. This mechanism automatically adjusts the influence of each time step according to the features and their temporal positions at the current time step, thereby enhancing the sensitivity and adaptive ability of the model to key temporal information and effectively dealing with complex XSS attack patterns.

[0027] (2) Extraction of XSS Spatial Structure Features:

[0028] Regarding the spatial structure features of XSS attack codes, the present invention proposes an Adaptive Adjacency Matrix Graph Convolutional Network (AAM-GCN) model to more precisely extract and express the structured information of attack carriers. First, the present invention uses the Density-Based Spatial Clustering of Applications with Noise (DBSCAN) algorithm to adaptively cluster nodes of different categories, thereby improving the recognition ability of key components such as Document Object Model (DOM) nodes, JavaScript code blocks, and event listeners, while filtering out noise data points and outliers to enhance the robustness of the model. Further, the present invention introduces an Adaptive Adjacency Matrix, enabling the model to dynamically learn the actual associations between nodes in the graph. Compared with traditional fixed adjacency matrix methods, AAM-GCN can adaptively adjust the edge weights between nodes, accurately capture complex spatial dependencies, thereby effectively reducing invalid connections and enhancing the learning ability of the Graph Convolutional Network (GCN). In addition, the present invention adopts a multi-layer GCN structure to gradually aggregate the information of neighbor nodes to continuously update node features, enabling the model to mine more complex graph structure information, thereby enhancing the expression ability of spatial features and improving the performance of XSS attack detection.

[0029] (3) Multi-Feature Fusion:

[0030] Aiming at the problem that the temporal features and spatial structure features come from different feature spaces and information loss may occur during the fusion process, the present invention proposes a feature fusion network based on adaptive shared representation space projection. This method generates a dynamic projection matrix for each modality, enabling the model to adaptively adjust the feature mapping method according to the characteristics of the input data, thereby effectively capturing the non-linear associations between different modality data and improving the effect of feature fusion. In addition, this method combines an adaptive weight adjustment mechanism to adaptively adjust the contribution weights of each modality in the shared space according to their relative importance in different detection scenarios. This mechanism can enhance the multi-modal feature fusion ability, make the distribution of features in the shared representation space more balanced, and thus significantly improve the accuracy and robustness of XSS attack detection. BRIEF DESCRIPTION OF THE DRAWINGS

[0031] Figure 1 It is a general architecture diagram of the present invention. DETAILED DESCRIPTION OF THE EMBODIMENTS

[0032] DETAILED DESCRIPTION OF THE EMBODIMENT 1: The specific process of an intelligent detection method for detecting cross-site scripting attacks in this embodiment is as follows:

[0033] The present invention proposes an XSS attack detection method based on Shared Spatiotemporal Feature Projection Fusion (SSFPF), and its general architecture is as Figure 1 shown. This method mainly includes three core modules: XSS temporal feature extraction, XSS spatial structure feature extraction, and multi-feature fusion. The specific designs of each module are as follows:

[0034] Step 1: Obtain XSS attack samples and normal traffic samples, and use the XSS attack samples and normal traffic samples as the training set;

[0035] XSS is cross-site scripting;

[0036] Step 2: Clean the XSS attack samples and normal traffic samples obtained in Step 1 to obtain the cleaned XSS attack samples and normal traffic samples;

[0037] For the original XSS data, the present invention adopts a multi-step data cleaning strategy to improve the data quality and reduce the interference of redundant features;

[0038] Step 3: Segment the cleaned XSS attack samples and normal traffic samples obtained in Step 2 to obtain multiple independent structured words;

[0039] Calculate the term frequency-inverse document frequency value of each word;

[0040] Select the top N (3000) words with the highest term frequency-inverse document frequency values to construct the core vocabulary for XSS attack detection;

[0041] Step 4: Construct an XSS attack detection model and obtain a trained XSS attack detection model based on the core vocabulary for XSS attack detection;

[0042] Step 5: Input the XSS sample to be tested into the trained XSS attack detection model, and the trained XSS attack detection model outputs whether the XSS sample to be tested is an attack sample or a normal traffic sample.

[0043] The XSS attack detection method based on shared spatio-temporal feature projection fusion (SSFPF) proposed by the present invention breaks through the bottleneck in feature extraction and fusion of traditional detection methods and has the following significant advantages:

[0044] Strong ability to extract temporal features: Combining Bi-LSTM and position-aware self-attention mechanism effectively improves the ability to capture key temporal information.

[0045] Accurate modeling of spatial structure features: Using AAM-GCN and DBSCAN clustering can dynamically learn the relationships between nodes and optimize the expression of structured information.

[0046] Efficient multi-feature fusion mechanism: Based on shared representation space projection and adaptive weight adjustment, it effectively integrates different modal information and improves the adaptability and generalization ability of the model.

[0047] In summary, the present invention constructs a novel XSS attack detection framework, which can more efficiently identify potential XSS attack behaviors, improve the Web security protection ability, and is applicable to a variety of complex network environments.

[0048] Specific implementation method 2: The difference between this implementation method and the first specific implementation method is that in step 1, XSS attack samples and normal traffic samples are obtained, and the XSS attack samples and normal traffic samples are used as the training set; XSS is cross-site scripting;

[0049] The specific process is as follows:

[0050] Collect XSS attack samples and at the same time obtain HTTP normal traffic samples from the real network environment;

[0051] The XSS attack samples are positive samples; XSS is cross-site scripting;

[0052] The normal traffic samples are negative samples;

[0053] The collected XSS attack data covers various types of XSS attack samples to ensure the diversity and representativeness of the dataset and provide comprehensive data support for model training;

[0054] The present invention has collected more than 30,000 XSS attack samples from XSSed vulnerability libraries, the PortSwigger vulnerability platform, and the payloadbox open-source collection, covering various attack methods such as reflected XSS, stored XSS, and DOM-based XSS;

[0055] At the same time, more than 30,000 HTTP normal traffic data have been collected from the real network environment to ensure the balance of the number of positive and negative samples in the dataset, improving the generalization ability and detection reliability of the model.

[0056] Other steps and parameters are the same as those in the first specific implementation manner.

[0057] Specific implementation manner three: The difference between this implementation manner and the first or second specific implementation manner is that in step two, the XSS attack samples and normal traffic samples obtained in step one are subjected to data cleaning to obtain the cleaned XSS attack samples and normal traffic samples;

[0058] The specific process is as follows:

[0059] Step 2-1: Standardize the XSS attack samples and normal traffic samples obtained in step one to obtain the standardized XSS attack samples and normal traffic samples;

[0060] The specific process is as follows:

[0061] Convert the case of the XSS attack samples and normal traffic samples obtained in step one (unify the case), and perform UTF-8 encoding on the XSS attack samples and normal traffic samples after case conversion to obtain the UTF-8 encoded XSS attack samples and normal traffic samples;

[0062] Step 2-2: Perform a decoding operation on the standardized XSS attack samples and normal traffic samples to obtain the decoded XSS attack samples and normal traffic samples; The specific process is as follows:

[0063] Step 2-2-1: Perform URL decoding (Uniform Resource Locator, URL decoding) on the standardized XSS attack samples and normal traffic samples to obtain the URL decoded XSS attack samples and normal traffic samples, and restore the potential malicious strings in the XSS attack samples and normal traffic samples;

[0064] Step Two Two Two: Perform HTML decoding (HyperText Markup Language, HTML decoding) on the XSS attack samples and normal traffic samples after URL decoding to obtain the XSS attack samples and normal traffic samples after HTML decoding, in order to restore the encoded HTML entities and reduce the confusion caused by encoding;

[0065] Step Two Three: Perform numerical and URL normalization on the decoded XSS attack samples and normal traffic samples obtained in Step Two Two to obtain the normalized XSS attack samples and normal traffic samples; The specific process is as follows:

[0066] Step Two Three One: Uniformly replace all the numbers in the decoded XSS attack samples and normal traffic samples obtained in Step Two Two with "0" to avoid the interference of specific numerical values on the model;

[0067] Step Two Three Two: Replace all the URL strings in the XSS attack samples and normal traffic samples obtained in Step Two Three One with "http: / / u" to ensure that the detection model focuses on the XSS code pattern rather than the specific URL content.

[0068] Other steps and parameters are the same as those in Specific Embodiment One or Two.

[0069] Specific Embodiment Four: The difference between this embodiment and one of Specific Embodiments One to Three is that in Step Three, the cleaned XSS attack samples and normal traffic samples obtained in Step Two are tokenized to obtain multiple independent structured words;

[0070] Calculate the term frequency-inverse document frequency value of each word;

[0071] Select the top N (3000) words with the highest term frequency-inverse document frequency values to construct the core vocabulary list for XSS attack detection;

[0072] The specific process is as follows:

[0073] Step Three One: Construct a tokenization rule (the specific content is shown in Table 1);

[0074] Step Three Two: Based on the tokenization rule, tokenize the cleaned XSS attack samples and normal traffic samples obtained in Step Two into multiple independent structured words;

[0075] Step Three Three: Screen each word; The specific process is as follows:

[0076] Filter out the common stop words in the words obtained in Step Three Two that have no contribution to feature extraction;

[0077] Step 34: Calculate the TF-IDF (Term Frequency-Inverse Document Frequency) weights of each word after filtering out stop words, and sort them in descending order;

[0078] Step 35: Select the top N (3000) words with the highest TF-IDF weights to construct the core vocabulary list of XSS attack samples and normal traffic samples, which will be used as the basis for subsequent feature extraction and modeling.

[0079] The number of matching rules for the same data sample ranges from 0 to 7, where 0 means no match at all, and 7 means all matching rules are covered simultaneously;

[0080] Each row on the left in Table 1 represents a word segmentation rule, and the right side is the functional explanation corresponding to each rule; The present invention designs a set of word segmentation rules including these several rules, and each rule takes effect simultaneously during actual application. The content matched by each rule is independent as a single word;

[0081] The regular expressions of the word segmentation rules include:

[0082] (?x)[\w\.]+?\(

[0083] <script\b[^>]*>([\s\S]*?)<\ / script>

[0084] "[^"]*"

[0085] '[^']*'

[0086] http[s]?: / / (?:[a-zA-Z]|[0-9]|[$-_@.&+]|[!*\\(\\),]|(?:%[0-9a-fA-F][0-9a-fA-F]))+\b(?:on\w+|src|href|data)\s*=\s*['"][^'"]*['"]

[0087] [\w\.]+

[0088] Table 1 Design of the normalized word segmentation rules of the present invention

[0089]

[0090] In the data set preprocessing stage, perform data cleaning operations on positive and negative samples, including duplicate removal, decoding, case conversion, etc., to reduce data redundancy and noise;

[0091] Other steps and parameters are the same as those in any one of the specific embodiments 1 to 3.

[0092] Embodiment 5: The difference between this embodiment and any one of Embodiments 1 to 4 is that: in Step 4, an XSS attack detection model is constructed, and a trained cross-site scripting (XSS) attack detection model is obtained based on the XSS attack detection core vocabulary list;

[0093] The specific process is as follows:

[0094] Step 4-1: Construct an XSS attack detection model;

[0095] The specific process is as follows:

[0096] The XSS attack detection model includes: a time series feature extraction model, a spatial structure feature extraction model, a multi-feature fusion model, and an XSS attack detector;

[0097] The time series feature extraction model sequentially includes: a Word2Vec word vector model, a bidirectional long short-term memory network (Bi-LSTM), and an adaptive position-aware attention mechanism;

[0098] The spatial structure feature extraction model sequentially includes: a feature clustering model, an adaptive adjacency matrix, and a graph convolutional network (GCN);

[0099] The XSS attack detector sequentially includes: a first fully connected layer, a second fully connected layer, a linear layer (Linear), and a Sigmoid activation function layer;

[0100] Step 4-2: Train the XSS attack detection model based on the XSS attack detection core vocabulary list to obtain a trained XSS attack detection model; the specific process is as follows:

[0101] Step 4-2-1: Input each word in the XSS attack detection core vocabulary list constructed in Step 3 into the time series feature extraction model, and the time series feature extraction model outputs time series features;

[0102] Step 4-2-2: Map the text feature vectors of each word in the XSS attack detection core vocabulary list constructed in Step 3, and input the mapped XSS attack detection core vocabulary list into the spatial structure feature extraction model, and the spatial structure feature extraction model outputs spatial structure features;

[0103] Step 4-2-3: Input the time series features output by the time series feature extraction model and the spatial structure features output by the spatial structure feature extraction model into the multi-feature fusion model, and the multi-feature fusion model outputs fused features;

[0104] Step 4-2-4: Input the fused feature vectors into the XSS attack detector, and the XSS attack detector outputs a predicted classification result;

[0105] Step 4-2-5: Calculate the loss function based on the predicted classification result and the true classification result output by the XSS attack detector;

[0106] Step 426: Repeat Steps 421 to 425 until the loss function converges to obtain a trained XSS attack detection model.

[0107] Other steps and parameters are the same as those in the first to fourth specific embodiments.

[0108] Specific Embodiment 6: The difference between this embodiment and any one of the first to fifth specific embodiments is that in Step 421, each word in the XSS attack detection core vocabulary constructed in Step 3 is input into the temporal feature extraction model, and the temporal feature extraction model outputs temporal features;

[0109] The specific process is as follows:

[0110] Step 4211: Input each word in the XSS attack detection core vocabulary constructed in Step 3 into the Word2Vec word vector model with a Skip-gram structure, and the Word2Vec word vector model with a Skip-gram structure outputs word vectors;

[0111] This method can effectively capture the semantic relationships and syntactic dependencies between words and improve the feature representation ability. The trained Word2Vec model can provide high-quality word vector representations for the XSS temporal feature extraction model, enabling the model to fully learn and utilize the semantic information of XSS attack codes, thereby improving the detection accuracy of XSS attacks;

[0112] Step 4212: Input the word vectors output by the Word2Vec word vector model into a bidirectional long short-term memory network, and the bidirectional long short-term memory network outputs a bidirectional hidden state H = [h1, h2, …, h i , …, h n ;

[0113] Among them,

[0114] h1 represents the hidden state of the bidirectional long short-term memory network at the first time step;

[0115] h2 represents the hidden state of the bidirectional long short-term memory network at the second time step;

[0116] h i represents the hidden state of the bidirectional long short-term memory network at the i-th time step, and i represents the i-th time step;

[0117] h n represents the hidden state of the bidirectional long short-term memory network at the n-th time step;

[0118] It can fully capture the context information of the input sequence;

[0119] Step 4213: Input the bidirectional hidden state H = [h1, h2, …, h i , …, h n into the adaptive position-aware attention mechanism, and the adaptive position-aware attention mechanism outputs the temporal features. The specific process is as follows:

[0120] Step 42131: Introduce the position encoding

[0121] where i represents the i-th time step, j is the dimension of the position encoding, and d is the dimension of the feature;

[0122] Step 42132: Concatenate the position encoding with the bidirectional hidden state H = [h1, h2, …, h i , …, h n output by the bidirectional long short-term memory network, and perform weighted calculations on the concatenated results with the weight matrices of the query Q (Query), key K (Key), and value V (Value) respectively, and output the query Q (Query), key K (Key), and value V (Value); expressed as:

[0123] H′ = H + P

[0124] Q = H′W Q , K = H′W K , V = H′W V

[0125] where W Q , W K , W V represent the weight matrices of the query Q (Query), key K (Key), and value V (Value) respectively;

[0126] Step 42133: Fuse the position encoding with the bidirectional hidden state H = [h1, h2, …, h i , …, h n output by the bidirectional long short-term memory network, and input the fused information into the feed-forward neural network. The feed-forward neural network outputs the attention weight α i for each time step; expressed as:

[0127] α i = ReLU(W1[h i ; p i + b1)W2 + b2

[0128] where W1 and W2 represent the weight matrices of the feed-forward neural network, and b1 and b2 represent the bias terms of the feed-forward neural network;

[0129] pi denotes the position encoding at the i-th time step; ReLU denotes the ReLU activation function;

[0130] Step 42134: Based on the attention mechanism, output the query Q, key K, value V, and the attention weight α for each time step i , calculate the output temporal feature Output(Q, K, V) of the adaptive position-aware attention mechanism; expressed as:

[0131]

[0132] where d k denotes the dimension of the feature; the superscript T denotes taking the transpose.

[0133] Other steps and parameters are the same as those in the first to fifth specific embodiments.

[0134] Temporal feature extraction: The preprocessed text samples are converted into low-dimensional and dense vector representations through a word vector model (Word to Vector, Word2Vec) to capture text semantic information. Subsequently, a bidirectional long short-term memory network (Bi-LSTM) is introduced to model the temporal dependencies of XSS attack codes, enabling the model to effectively extract key context features. In addition, by combining the adaptive position-aware attention mechanism, the model can fuse temporal information and position information, thereby enhancing the expressive power of temporal features and making them more adaptable to complex XSS attack pattern analysis.

[0135] Specific embodiment 7: The difference between this embodiment and one of the first to sixth specific embodiments is that in step 422, each word in the XSS attack detection core vocabulary constructed in step 3 is mapped to a text feature vector, and the mapped XSS attack detection core vocabulary is input into the spatial structure feature extraction model, and the spatial structure feature extraction model outputs the spatial structure features;

[0136] The specific process is as follows:

[0137] Step 4221: Quantify all words in the XSS attack detection core vocabulary constructed in step 3 based on the TF-IDF (Term Frequency-Inverse Document Frequency) method to obtain all node features (mapping);

[0138] Step 4222: Use the Density-Based Spatial Clustering of Applications with Noise (DBSCAN) algorithm to perform feature clustering on node features. After clustering, each node will be assigned a clustering label C i ;

[0139] Step 4223: Generate an adaptive adjacency matrix based on the clustered node features obtained in Step 4222;

[0140] The specific process is as follows:

[0141] Use the Gaussian kernel method to calculate the feature similarity S between any node pair (i, j) within each cluster (the node pair is any node pair within one cluster) ij ; Expressed as:

[0142]

[0143] where h i and h j represent the feature vectors of node i and node j within the same cluster respectively, and μ is the width parameter of the Gaussian kernel;

[0144] According to the clustering labels of the nodes and the feature similarity S between the node pairs ij , generate the adaptive adjacency matrix A ij ; Expressed as:

[0145]

[0146] where C i represents the clustering label of node i; C j represents the clustering label of node j;

[0147] Step 4224: Normalize the adaptive adjacency matrix A ij (using min-max normalization) to obtain the normalized adjacency matrix;

[0148] Input the normalized adjacency matrix into the first Graph Convolutional Network (GCN), the second GCN, the third GCN, and the fourth GCN in sequence. The fourth GCN outputs the spatial structure features;

[0149] The calculation steps of each GCN are as follows:

[0150] where

[0151]

[0152] Denotes the normalized adjacency matrix (including self-loops);

[0153] W (l) Denotes the weight matrix of the l-th Graph Convolutional Network (GCN);

[0154] The l-th Graph Convolutional Network (GCN) represents the first Graph Convolutional Network (GCN), the second Graph Convolutional Network (GCN), or the third Graph Convolutional Network (GCN);

[0155] σ denotes the activation function;

[0156] H (l) Denotes the output spatial structure features of the l-th Graph Convolutional Network (GCN);

[0157] H (l+1) Denotes the output spatial structure features of the (l + 1)-th Graph Convolutional Network (GCN).

[0158] Extract and capture higher-order graph structure information layer by layer through a four-layer Graph Convolutional Network (GCN).

[0159] Other steps and parameters are the same as those in any one of the specific embodiments one to six.

[0160] Spatial structure feature extraction: On the basis of temporal feature extraction, the present invention further constructs the spatial structure features of the XSS attack vector. First, text features are quantified based on TF-IDF, and a graph structure is constructed through a feature clustering method to aggregate relevant features, so as to enhance the model's ability to model the correlation between similar features. In addition, the present invention proposes an Adaptive Adjacency Matrix Graph Convolutional Network (AAM-GCN) to further improve the effectiveness of structure feature extraction. Among them, the Adaptive Adjacency Matrix can automatically adjust the influence between nodes according to the relationship between features, while the Graph Convolutional Network (GCN) captures the deep relationship in the graph structure by aggregating neighbor node information. By combining feature clustering and the AAM-GCN network, the present invention effectively compresses and focuses on key features, enhances the expression ability of node relationships, and thus improves the spatial structure feature representation ability of XSS attack detection.

[0161] Embodiment VIII: The difference between this embodiment and any one of Embodiments I to VII is that in step 4222, the Density-Based Spatial Clustering of Applications with Noise (DBSCAN) algorithm is used to perform feature clustering on the node features. After the clustering is completed, each node will be assigned a clustering label C i ;

[0162] The specific process is as follows:

[0163] 1) Initialize all the node features obtained in step 4221 as unvisited feature points;

[0164] 2) Set the neighborhood radius ε;

[0165] Check the neighborhood centered at the current feature point with a radius of ε;

[0166] 3) If the number of feature points in the neighborhood is greater than or equal to minPts, then classify the feature points in the neighborhood into the same cluster;

[0167] minPts is the set minimum number of samples;

[0168] 4) If the above conditions are not met, then mark the points in the neighborhood as noise points and do not participate in the graph structure construction;

[0169] Among them, the neighborhood radius calculation formula is as follows:

[0170]

[0171] dist(p,q)≤ε

[0172] Among them, dist(p,q) represents the distance between feature point p and feature point q;

[0173] p and q are any two feature points among all the feature points obtained in 1);

[0174] p i represents the value of the i-th dimension of feature point p;

[0175] q i represents the value of the i-th dimension of feature point q;

[0176] N is the total dimension of each feature point, that is, the total number of all words in the XSS attack detection core vocabulary.

[0177] Other steps and parameters are the same as those in Embodiments I to VII.

[0178] Embodiment Nine: The difference between this embodiment and any one of Embodiments One to Eight is that in Step 423, the temporal features output by the temporal feature extraction model and the spatial structure features output by the spatial structure feature extraction model are input into the multi-feature fusion model, and the multi-feature fusion model outputs the fused features;

[0179] The specific process is as follows:

[0180] 1), Input the temporal features output by the temporal feature extraction model into the normalization network, and the normalization network outputs the temporal feature projection matrix; expressed as:

[0181]

[0182] Wherein,

[0183] W1, W2, and W3 are the weight matrices of the self-normalization network;

[0184] b1, b2, and b3 are the bias terms of the self-normalization network;

[0185] h T Represents the temporal features;

[0186] W T Represents the temporal feature projection matrix;

[0187] Represents the intermediate variable;

[0188] SELU and tanh are activation functions;

[0189] Self-Normalizing Neural Networks (SNN) is an existing neural network architecture, first proposed by Günter Klambauer et al. in 2017. The core lies in the introduction of an activation function called Scaled Exponential Linear Units (SELU).

[0190] 2), Input the spatial structure features output by the spatial structure feature extraction model into the normalization network, and the normalization network outputs the spatial structure feature projection matrix; expressed as:

[0191]

[0192] Wherein,

[0193] W1, W2, and W3 are the weight matrices of the self-normalization network;

[0194] b1, b2, and b3 are the bias terms of the self-normalization network;

[0195] hG Represents the spatial structure feature;

[0196] W G Represents the projection matrix of the spatial structure feature;

[0197] Represents an intermediate variable;

[0198] SELU and tanh are activation functions;

[0199] 3), Based on the temporal feature h T Obtain the adaptive feature weight α T ;

[0200] Based on the spatial structure feature h G Obtain the adaptive feature weight α of the spatial structure feature G ;

[0201] The specific calculation process is as follows:

[0202] α T = fα T (h T ), α G = fα G (h G )

[0203] Among them,

[0204] fα T Represents the temporal feature adaptive weight adjustment network, fα G Represents the spatial structure feature adaptive weight adjustment network;

[0205] α T Represents the adaptive feature weight of the temporal feature, α G Represents the adaptive feature weight of the spatial structure feature;

[0206] The temporal feature adaptive weight adjustment network is a multi-layer perceptron MLP;

[0207] The spatial structure feature adaptive weight adjustment network is a multi-layer perceptron MLP;

[0208] 4), Based on the adaptive feature weight α T , The temporal feature projection matrix W T , Adjust the temporal feature h T To obtain the adjusted temporal feature Expressed as:

[0209]

[0210] Based on the adaptive feature weight α of the spatial structure feature G, the spatial structure feature projection matrix W G , adjust the spatial structure feature h G , and obtain the adjusted spatial structure feature which is expressed as:

[0211]

[0212] Concatenate the adjusted temporal feature with the adjusted spatial structure feature to generate the final fused feature vector h fused ; which is expressed as:

[0213]

[0214] The fused feature vector h fused has been aligned in the shared representation space projection fusion model, fully containing the XSS temporal information and spatial structure information.

[0215] Multi-feature fusion: The XSS temporal feature and spatial structure feature of the present invention come from different feature spaces. In order to achieve efficient fusion, it is necessary to construct a shared representation space to align the two types of features. In the shared representation space, the temporal feature and spatial structure feature are mapped to the same semantic space through the feature projection operation, enabling them to be compared and fused in a unified semantic environment. Through this strategy, deep interaction between different modality features can be ensured, thereby enhancing the overall performance of XSS attack detection.

[0216] Other steps and parameters are the same as those in the first to eighth specific embodiments.

[0217] Specific embodiment ten: The difference between this embodiment and one of the first to ninth specific embodiments is that in step 424, the fused feature vector is input into the XSS attack detector, and the XSS attack detector outputs a predicted classification result;

[0218] The specific process is as follows:

[0219] Input the fused feature vector h fused into the first fully connected layer, the second fully connected layer, the linear layer, and the Sigmoid activation function layer in sequence. The Sigmoid activation function layer outputs a classification prediction result to determine whether the input sample belongs to an XSS attack; the calculation formula is as follows:

[0220]

[0221] where,

[0222] and are the weight matrices of the first fully connected layer and the second fully connected layer respectively;

[0223] and are the bias terms of the first fully connected layer and the second fully connected layer respectively;

[0224] represents the final XSS classification prediction result;

[0225] W fc is the weight matrix of the linear layer, and b fc is the bias term of the linear layer;

[0226] Sigmoid is the Sigmoid activation function;

[0227] ReLU is the ReLU activation function;

[0228] h fc1 represents the output features of the first fully connected layer;

[0229] h fc2 represents the output features of the second fully connected layer.

[0230] After passing through two fully connected layers, the dimensionality is gradually reduced to improve the classification effect. The output dimension of each layer is gradually reduced until the final binary classification layer. In the classification stage, a single neuron output layer with the Sigmoid activation function generates the binary classification prediction result to determine whether the input sample belongs to an XSS attack.

[0231] Other steps and parameters are the same as those in Embodiments 1 to 9.

[0232] The XSS attack detection method based on SSFPF proposed by the present invention, on the basis of fusing multi-modal features, improves the generalization ability and detection accuracy of the detection model through shared spatiotemporal feature projection, effectively enhances the adaptability to unknown attack samples, and provides an efficient and reliable XSS attack detection scheme for Web application security.

[0233] The following embodiments are used to verify the beneficial effects of the present invention:

[0234] Embodiment 1:

[0235] The present invention provides a cross-site scripting (XSS) attack detection method based on shared spatiotemporal feature projection fusion (SSFPF):

[0236] (1) Dataset collection:

[0237] The present invention collected more than 30,000 XSS attack samples from the XSSed vulnerability library, the PortSwigger vulnerability platform, and the payloadbox open-source collection, covering various attack methods such as reflected XSS, stored XSS, and DOM-based XSS. At the same time, more than 30,000 HTTP normal traffic data were collected from the real network environment to ensure the balance of the number of positive and negative samples in the dataset, improving the generalization ability and detection reliability of the model.

[0238] (2) Data cleaning:

[0239] For the original XSS data, the present invention adopts a multi-step data cleaning strategy to improve data quality and reduce the interference of redundant features:

[0240] Standardization processing: Perform case conversion (unify case) on the XSS attack samples and normal traffic samples obtained in step one, and perform UTF-8 encoding on the XSS attack samples and normal traffic samples after case conversion to obtain the XSS attack samples and normal traffic samples after UTF-8 encoding;

[0241] Multi-level decoding: (1) Perform URL decoding (Uniform Resource Locator, URL decoding) on the standardized XSS attack samples and normal traffic samples to obtain the XSS attack samples and normal traffic samples after URL decoding, and restore the potential malicious strings in the XSS attack samples and normal traffic samples; (2) Perform HTML decoding (HyperText Markup Language, HTML decoding) on the XSS attack samples and normal traffic samples after URL decoding to obtain the XSS attack samples and normal traffic samples after HTML decoding, in order to restore the encoded HTML entities, thereby reducing the confusion caused by encoding;

[0242] Numerical and URL normalization: (1) Replace all the numbers in the decoded XSS attack samples and normal traffic samples obtained in step two with "0" to avoid the interference of specific numerical values to the model; (2) Replace all the URL strings in the XSS attack samples and normal traffic samples obtained in step two with "http: / / u" to ensure that the detection model focuses on the XSS code pattern rather than the specific URL content.

[0243] (3) Word segmentation and feature table construction:

[0244] The present invention designs a set of standardized word segmentation rules (specific content is shown in Table 1) for segmenting XSS code into multiple independent structured elements for subsequent feature extraction. For the word segmentation results, the present invention uses the Term Frequency-Inverse Document Frequency (TF-IDF) method for feature screening and weight calculation, and the specific steps are as follows:

[0245] Count the occurrence frequencies of all words in the positive samples (XSS attack codes) and negative samples;

[0246] Filter out common stop words that contribute nothing to feature extraction;

[0247] Calculate the TF-IDF weights of each word and sort them in descending order;

[0248] Select the top 3000 words with the highest TF-IDF values to construct the core vocabulary for XSS attack detection as the basis for subsequent feature extraction and modeling.

[0249] (4) Word2Vec Word Vector and Feature Clustering Method

[0250] The present invention proposes an XSS attack detection method based on the Word2Vec word vector model and feature clustering. Before performing Word2Vec word vector training and feature clustering to construct a graph structure, corresponding model hyperparameters and clustering algorithm hyperparameters need to be set in advance.

[0251] The Word2Vec word vector parameters are:

[0252] embedding_size (dimension of the embedding vector): 128

[0253] skip_window (window size): 5

[0254] The clustering algorithm hyperparameters are:

[0255] The neighborhood radius ε is set to 0.8, and the minimum number of neighbors minPts for core points is set to 5.

[0256] 1) Word2Vec Word Vector Model

[0257] The present invention adopts the Word2Vec word vector model with a Skip-gram structure, predicts the context through the target word, and thus maps the word into a high-dimensional vector space. This method can effectively capture the semantic relationships and syntactic dependencies between words, and improve the feature representation ability. The trained Word2Vec model can provide high-quality word vector representations for the XSS time series feature extraction model, enabling the model to fully learn and utilize the semantic information of XSS attack codes, thereby improving the detection accuracy of XSS attacks.

[0258] 2) Feature clustering based on DBSCAN

[0259] The present invention uses the TF-IDF (Term Frequency-Inverse Document Frequency) method to quantify the text features of XSS attack codes, and constructs feature vectors based on this. Subsequently, the Density-Based Spatial Clustering of Applications with Noise (DBSCAN) algorithm is used for feature clustering to establish a graph structure representation of XSS codes. The DBSCAN clustering process is as follows:

[0260] 1) Initialize all node features as unvisited feature points;

[0261] 2) Set the neighborhood radius ε;

[0262] Check the neighborhood centered at the current feature point with a radius of ε;

[0263] 3) If the number of feature points in the neighborhood is greater than or equal to minPts, then classify the feature points in the neighborhood into the same cluster;

[0264] minPts is the set minimum number of samples;

[0265] 4) If the above conditions are not met, then mark the points in the neighborhood as noise points and do not participate in the graph structure construction;

[0266] Among them, the neighborhood radius calculation formula is as follows:

[0267]

[0268] dist(p,q) ≤ ε

[0269] Among them, dist(p,q) represents the distance between feature point p and feature point q;

[0270] p and q are any two feature points among all the feature points obtained in 1);

[0271] p iRepresents the value of the i-th dimension of the feature point p;

[0272] q i Represents the value of the i-th dimension of the feature point q;

[0273] N is the total dimension of each feature point, that is, the total number of all words in the core vocabulary for XSS attack detection.

[0274] (5) Establish a temporal feature extraction model

[0275] Input the word vectors output by the Word2Vec word vector model into a bidirectional long short-term memory network, and the bidirectional long short-term memory network outputs a bidirectional hidden state H = [h1, h2,..., h i ,…,h n ;

[0276] Among them,

[0277] h1 represents the hidden state of the bidirectional long short-term memory network at the first time step;

[0278] h2 represents the hidden state of the bidirectional long short-term memory network at the second time step;

[0279] h i represents the hidden state of the bidirectional long short-term memory network at the i-th time step, where i represents the i-th time step;

[0280] h n represents the hidden state of the bidirectional long short-term memory network at the n-th time step;

[0281] It can fully capture the context information of the input sequence;

[0282] 3) Input the bidirectional hidden state H = [h1, h2,..., h i ,…,h n output by the bidirectional long short-term memory network into an adaptive position-aware attention mechanism, and the adaptive position-aware attention mechanism outputs temporal features; the specific process is as follows:

[0283] 31) Introduce positional encoding

[0284] Among them, i represents the i-th time step, j is the dimension of the positional encoding, and d is the dimension of the feature;

[0285] 32) Combine the positional encoding with the bidirectional hidden state H = [h1, h2,..., h i ,…,h nConcatenate, and after concatenation, the results are respectively weighted and calculated with the weight matrices of query Q (Query), key K (Key), and value V (Value), and the query Q (Query), key K (Key), and value V (Value) are output; expressed as:

[0286] H′ = H + P

[0287] Q = H′W Q , K = H′W K , V = H′W V

[0288] Among them, W Q , W K , W V respectively represent the weight matrices of query Q (Query), key K (Key), and value V (Value);

[0289] 33), Combine the positional encoding with the bidirectional hidden state H = [h1, h2, …, h i , …, h n output by the bidirectional long short-term memory network, and the combined information is input into the feed-forward neural network, and the feed-forward neural network outputs the attention weight α i at each time step; expressed as:

[0290] α i = ReLU(W1[h i ; p i +b1)W2 + b2

[0291] Among them, W1 and W2 represent the weight matrices of the feed-forward neural network, and b1 and b2 represent the bias terms of the feed-forward neural network;

[0292] p i represents the positional encoding at the i-th time step; ReLU represents the ReLU activation function;

[0293] 34), Based on the attention mechanism, output query Q, key K, value V, and the attention weight α i at each time step, and calculate the adaptive position-aware attention mechanism to output the temporal feature Output(Q, K, V); expressed as:

[0294]

[0295] Among them, d k represents the dimension of the feature; the superscript T represents taking the transpose.

[0296] (6) Establish a spatial structure feature extraction model

[0297] During the construction of the graph structure, the node features are clustered. After the clustering is completed, each node will be assigned a clustering label C i Subsequently, the Gaussian kernel similarity is used to calculate the feature similarity between any node pair (i, j), and the similarity value S between the node pairs is determined based on this similarity metric ij Finally, an adaptive adjacency matrix A is generated according to the clustering labels of the nodes and their similarity values ij The relevant calculation formulas are as follows:

[0298]

[0299] where h i and h j represent the feature vectors of nodes i and j respectively, and σ is the width parameter of the Gaussian kernel. Finally, higher-order graph structure information is extracted and captured layer by layer through a four-layer graph convolutional network (GCN). The calculation steps of each GCN layer are as follows:

[0300]

[0301] where

[0302] represents the normalized adjacency matrix (including self-loops);

[0303] W (l) represents the weight matrix of the l-th graph convolutional network GCN;

[0304] The l-th graph convolutional network GCN represents the first graph convolutional network GCN, the second graph convolutional network GCN or the third graph convolutional network GCN;

[0305] σ represents the activation function;

[0306] H (l) represents the output spatial structure features of the l-th graph convolutional network GCN;

[0307] H (l+1) represents the output spatial structure features of the (l + 1)-th graph convolutional network GCN

[0308] (7) Shared representation space projection

[0309] Input the extracted XSS time series features and spatial structure features into the shared representation space projection fusion model, and generate the projection matrix corresponding to each modality through a self-normalizing neural network. Subsequently, the adaptive feature weights α T and α G are introduced, where the adaptive weight network adopts a multi-layer perceptron (MLP) and dynamically generates weights according to the input features. The specific calculation process is as follows:

[0310] 1), Input the temporal features output by the temporal feature extraction model into the shared representation space projection fusion model, and the shared representation space projection fusion model outputs the temporal feature projection matrix; expressed as:

[0311]

[0312] Among them,

[0313] W1, W2, and W3 are the weight matrices of the self-normalizing network;

[0314] b1, b2, and b3 are the bias terms of the self-normalizing network;

[0315] h T represents the temporal features;

[0316] W T represents the temporal feature projection matrix;

[0317] represents the intermediate variable;

[0318] SELU and tanh are activation functions;

[0319] The self-normalizing network (Self-Normalizing Neural Networks, SNN) is an existing neural network architecture, first proposed by Günter Klambauer et al. in 2017. The core lies in the introduction of an activation function called Scaled Exponential Linear Units (SELU).

[0320] 2), Input the spatial structure features output by the spatial structure feature extraction model into the shared representation space projection fusion model, and the shared representation space projection fusion model outputs the spatial structure feature projection matrix; expressed as:

[0321]

[0322] Among them,

[0323] W1, W2, and W3 are the weight matrices of the self-normalizing network;

[0324] b1, b2, and b3 are the bias terms of the self-normalizing network;

[0325] h G represents the spatial structure features;

[0326] W G represents the spatial structure feature projection matrix;

[0327] represents the intermediate variable;

[0328] SELU and tanh are activation functions;

[0329] 3), Based on the temporal feature h T Obtain the adaptive feature weight α T ;

[0330] Based on the spatial structure feature h G Obtain the adaptive feature weight α of the spatial structure feature G ;

[0331] The specific calculation process is as follows:

[0332] α T = fα T (h T ), α G = fα G (h G )

[0333] Among them,

[0334] fα T represents the temporal feature adaptive weight adjustment network, and fα G represents the spatial structure feature adaptive weight adjustment network;

[0335] α T represents the adaptive feature weight of the temporal feature, and α G represents the adaptive feature weight of the spatial structure feature;

[0336] The temporal feature adaptive weight adjustment network is a multi-layer perceptron MLP;

[0337] The spatial structure feature adaptive weight adjustment network is a multi-layer perceptron MLP;

[0338] 4), Based on the adaptive feature weight α T , the temporal feature projection matrix W T , adjust the temporal feature h T to obtain the adjusted temporal feature which is expressed as:

[0339]

[0340] Based on the adaptive feature weight α of the spatial structure feature G , the spatial structure feature projection matrix W G , adjust the spatial structure feature h G to obtain the adjusted spatial structure feature which is expressed as:

[0341]

[0342] The adjusted temporal features and the adjusted spatial structure features are concatenated to generate the final fused feature vector h fused ; which is expressed as:

[0343]

[0344] (8) The fused feature vector h fused has been aligned in the shared latent space, fully containing the XSS temporal information and spatial structure information. Subsequently, this feature vector is gradually reduced in dimension through two fully connected layers in sequence. The output dimension of each layer usually gradually decreases until reaching the final classification layer. Finally, the class prediction result is generated through a single-neuron output layer with a Sigmoid activation function to determine whether the input is an XSS attack. The calculation formula is as follows:

[0345] The fused feature vector h fused is sequentially input into the first fully connected layer, the second fully connected layer, the linear layer, and the Sigmoid activation function layer. The Sigmoid activation function layer outputs the classification prediction result to determine whether the input sample belongs to an XSS attack; the calculation formula is as follows:

[0346]

[0347] where

[0348] and are the weight matrices of the first fully connected layer and the second fully connected layer respectively;

[0349] and are the bias terms of the first fully connected layer and the second fully connected layer respectively;

[0350] represents the final XSS classification prediction result;

[0351] W fc is the weight matrix of the linear layer, and b fc is the bias term of the linear layer;

[0352] Sigmoid is the Sigmoid activation function;

[0353] ReLU is the ReLU activation function;

[0354] h fc1 represents the output feature of the first fully connected layer;

[0355] h fc2 represents the output feature of the second fully connected layer.

[0356] After passing through two fully connected layers, the dimensionality is gradually reduced to improve the classification effect. The output dimensionality of each layer is gradually reduced until the final binary classification layer. In the classification stage, a single-neuron output layer with a Sigmoid activation function generates the binary classification prediction result to determine whether the input sample belongs to an XSS attack.

[0357] (9) After the model parameters are trained, the accuracy and F1-score are used to evaluate the model performance.

[0358]

[0359] In the calculation of the above metrics, TP (True Positive) represents the number of XSS samples correctly classified as XSS attack samples, TN (True Negative) represents the number of XSS benign samples correctly classified as XSS benign samples, FP (False Positive) represents the number of XSS benign samples misclassified as XSS attack samples, and FN (False Negative) represents the number of XSS attack samples misclassified as XSS benign samples.

[0360] (10) The comparison of the detection results of the present invention with different baseline models is shown in Table 2.

[0361] Table 2 Comparison of the present invention with different baseline models in terms of accuracy and F1-score

[0362] Model Accuracy(%) F1-score(%) Bi-LSTM 96.57 95.17 Bi-LSTM + Adaptive Position-Aware Attention Mechanism 97.92 97.64 GCN 97.54 97.51 AAM-GCN 98.55 95.46 SSFPF (No Shared Representation Space Projection) 99.21 99.04 SSFPF 99.86 99.77

[0363] Through the analysis of the experimental results, it can be obtained that in the field of XSS attack detection, the method proposed by the present invention can effectively improve the detection accuracy and F1-score.

[0364] The present invention can also have many other embodiments. Without departing from the spirit and essence of the present invention, those skilled in the art can make various corresponding changes and deformations according to the present invention, but these corresponding changes and deformations should all fall within the protection scope of the appended claims of the present invention.

Claims

1. An intelligent detection method for detecting cross-site scripting attacks, characterized in that: The specific process of the method is as follows: Step 1: Obtain XSS attack samples and normal traffic samples, and use the XSS attack samples and normal traffic samples as the training set; XSS stands for cross-site scripting; Step 2: Clean the XSS attack samples and normal traffic samples obtained in Step 1 to obtain the cleaned XSS attack samples and normal traffic samples; Step 3: Segment the cleaned XSS attack samples and normal traffic samples obtained in Step 2 to obtain words; Calculate the term frequency-inverse document frequency value of each word; Select the top N words with the highest term frequency-inverse document frequency value to construct the core vocabulary list for XSS attack detection; Step 4: Construct an XSS attack detection model, and obtain a trained XSS attack detection model based on the core vocabulary list for XSS attack detection; Step 5: Input the XSS sample to be tested into the trained XSS attack detection model, and the trained XSS attack detection model outputs whether the XSS sample to be tested is an attack sample or a normal traffic sample.

2. The intelligent detection method for detecting cross - site scripting attacks according to claim 1, wherein: In Step 1, obtain XSS attack samples and normal traffic samples, and use the XSS attack samples and normal traffic samples as the training set; XSS stands for cross-site scripting; The specific process is as follows: Collect XSS attack samples, and at the same time obtain HTTP normal traffic samples from the real network environment; The XSS attack samples are positive samples, and XSS stands for cross-site scripting; The normal traffic samples are negative samples.

3. An intelligent detection method for detecting cross-site scripting attacks according to claim 2, characterized in that: In Step 2, clean the XSS attack samples and normal traffic samples obtained in Step 1 to obtain the cleaned XSS attack samples and normal traffic samples; the specific process is as follows: Step 2-1: Standardize the XSS attack samples and normal traffic samples obtained in Step 1 to obtain the standardized XSS attack samples and normal traffic samples; the specific process is as follows: Convert the case of the XSS attack samples and normal traffic samples obtained in Step 1, and perform UTF-8 encoding on the case-converted XSS attack samples and normal traffic samples to obtain the UTF-8 encoded XSS attack samples and normal traffic samples; Step 2-2: Perform a decoding operation on the standardized XSS attack samples and normal traffic samples to obtain the decoded XSS attack samples and normal traffic samples; the specific process is as follows: Step 2-2-1: Perform URL decoding on the standardized XSS attack samples and normal traffic samples to obtain the URL decoded XSS attack samples and normal traffic samples; Step 2-2-2: Perform HTML decoding on the URL decoded XSS attack samples and normal traffic samples to obtain the HTML decoded XSS attack samples and normal traffic samples; Step 2-3: Perform numerical and URL normalization on the decoded XSS attack samples and normal traffic samples obtained in Step 2-2 to obtain the normalized XSS attack samples and normal traffic samples; the specific process is as follows: Step 2-3-1: Uniformly replace all numbers in the decoded XSS attack samples and normal traffic samples obtained in Step 2-2 with "0"; Step 2-3-2: Replace all URL strings in the XSS attack samples and normal traffic samples obtained in Step 2-3-1 with "http: / / u".

4. An intelligent detection method for detecting cross-site scripting attacks according to claim 3, characterized in that: In step 3, the cleaned XSS attack samples and normal traffic samples obtained in step 2 are segmented to obtain words; Calculate the term frequency-inverse document frequency value of each word; Select the top N words with the highest term frequency-inverse document frequency values to construct the core vocabulary for XSS attack detection; The specific process is as follows: Step 3-1: Construct a word segmentation rule; Step 3-2: Based on the word segmentation rule, segment the cleaned XSS attack samples and normal traffic samples obtained in step 2 into words; Step 3-3: Screen each word; the specific process is as follows: Filter out the stop words in the words obtained in step 3-2; Step 3-4: Calculate the term frequency-inverse document frequency TF-IDF weights of each word after filtering out the stop words and sort them in descending order; Step 3-5: Select the top N words with the highest TF-IDF weight values to construct the core vocabulary for XSS attack samples and normal traffic samples.

5. An intelligent detection method for detecting cross-site scripting attacks according to claim 4, characterized in that: In step 4, construct an XSS attack detection model and obtain a trained XSS attack detection model based on the core vocabulary for XSS attack detection; the specific process is as follows: Step 4-1: Construct an XSS attack detection model; the specific process is as follows: The XSS attack detection model includes: a time series feature extraction model, a spatial structure feature extraction model, a multi-feature fusion model, and an XSS attack detector; The time series feature extraction model sequentially includes: a Word2Vec word vector model, a bidirectional long short-term memory network, and an adaptive position-aware attention mechanism; The spatial structure feature extraction model sequentially includes: a feature clustering model, an adaptive adjacency matrix, and a graph convolutional network GCN; The XSS attack detector sequentially includes: a first fully connected layer, a second fully connected layer, a linear layer Linear, and a Sigmoid activation function layer; Step 4-2: Train the cross-site scripting XSS attack detection model based on the core vocabulary for XSS attack detection to obtain a trained XSS attack detection model; the specific process is as follows: Step 4-2-1: Input each word in the core vocabulary for XSS attack detection constructed in step 3 into the time series feature extraction model, and the time series feature extraction model outputs time series features; Step 4-2-2: Map the text feature vectors of each word in the core vocabulary for XSS attack detection constructed in step 3, and the mapped core vocabulary for XSS attack detection is input into the spatial structure feature extraction model, and the spatial structure feature extraction model outputs spatial structure features; Step 4-2-3: Input the time series features output by the time series feature extraction model and the spatial structure features output by the spatial structure feature extraction model into the multi-feature fusion model, and the multi-feature fusion model outputs fusion features; Step 4-2-4: Input the fused feature vectors into the XSS attack detector, and the XSS attack detector outputs a predicted classification result; Step 4-2-5: Calculate the loss function based on the predicted classification result and the true classification result output by the XSS attack detector; Step 4-2-6: Repeat steps 4-2-1 to 4-2-5 until the loss function converges to obtain a trained XSS attack detection model.

6. The intelligent detection method for detecting cross-site scripting attacks according to claim 5, characterized in that: In Step 421, each word in the core vocabulary for XSS attack detection constructed in Step 3 is input into the time series feature extraction model, and the time series feature extraction model outputs the time series feature; The specific process is as follows: Step 4211: Each word in the core vocabulary for XSS attack detection constructed in Step 3 is input into the Word2Vec word vector model, and the Word2Vec word vector model outputs the word vector; Step 4212: Input the word vectors output by the Word2Vec word vector model into the bidirectional long short-term memory network, and the bidirectional long short-term memory network outputs a bidirectional hidden state H = [h1, h2, …, h i , …, h n ; Among them, h1 represents the hidden state of the bidirectional long short-term memory network at the first time step; h2 represents the hidden state of the bidirectional long short-term memory network at the second time step; h i represents the hidden state of the bidirectional long short-term memory network at the i-th time step, where i represents the i-th time step; h n represents the hidden state of the bidirectional long short-term memory network at the n-th time step; Step 4213: Input the bidirectional hidden state H = [h1, h2, …, h i , …, h n into the adaptive position-aware attention mechanism, and the adaptive position-aware attention mechanism outputs temporal features. The specific process is as follows: Step 42131: Introduce positional encoding Among them, i represents the i-th time step, j is the dimension of the position encoding, and d is the dimension of the feature; Step 42132: Embed the positional encoding with the bidirectional hidden state H = [h1, h2, …, h i , …, h n of the bidirectional long short-term memory network. After concatenation, the resulting vectors are weighted by the weight matrices of the query Q, key K, and value V respectively, and the query Q, key K, and value V are output, expressed as: H′ = H + P Q = H′W Q , K = H′W K , V = H′W V Among them, W Q , W K , W V represent the weight matrices of the query Q, the key K, and the value V respectively; Step 42133: Embed the positional encoding with the bidirectional hidden state H = [h1, h2, …, h i , …, h n output by the bidirectional long short-term memory network. The fused information is input into a feed-forward neural network, and the feed-forward neural network outputs the attention weight α i at each time step; which is expressed as: α i = ReLU(W1[h i ; p i + b1)W2 + b2 Among them, W1 and W2 represent the weight matrices of the feed-forward neural network, and b1 and b2 represent the bias terms of the feed-forward neural network; p i represents the position encoding at the i-th time step; ReLU represents the ReLU activation function; Step 42134: Output the query Q, key K, value V, and the attention weight α at each time step based on the attention mechanism i , and calculate the output temporal feature Output(Q, K, V) of the adaptive position-aware attention mechanism; expressed as: where d k represents the dimension of the feature; the superscript T represents taking the transpose.

7. An intelligent detection method for detecting cross-site scripting attacks according to claim 6, characterized in that: In Step 422, each word in the core vocabulary for XSS attack detection constructed in Step 3 is subjected to text feature vector mapping, and the mapped core vocabulary for XSS attack detection is input into the spatial structure feature extraction model, and the spatial structure feature extraction model outputs the spatial structure feature; The specific process is as follows: Step 4221: All words in the core vocabulary for XSS attack detection constructed in Step 3 are quantified based on the TF-IDF method to obtain all node features; Step 4222: Feature clustering of the node features is performed based on the density-based spatial clustering of applications with noise (DBSCAN) algorithm. After the clustering is completed, each node will be assigned a clustering label; Step 4223: An adaptive adjacency matrix is generated based on the clustered node features obtained in Step 4222; The specific process is as follows: Calculate the feature similarity S between any node pairs (i, j) within each cluster using the Gaussian kernel method ij ; It is expressed as: where h i and h j represent the feature vectors of nodes i and j in the same cluster respectively, and μ is the width parameter of the Gaussian kernel; According to the clustering labels of the nodes and the feature similarity S between node pairs ij an adaptive adjacency matrix A is generated ij which is expressed as: Among them, C i represents the clustering label of node i; C j represents the clustering label of node j; Step Four Two Two Four: Normalize the adaptive adjacency matrix A ij to obtain the normalized adjacency matrix; The normalized adjacency matrix is successively input into the first graph convolutional network (GCN), the second graph convolutional network (GCN), the third graph convolutional network (GCN), and the fourth graph convolutional network (GCN). The fourth graph convolutional network (GCN) outputs the spatial structure feature; The calculation steps of each graph convolutional network (GCN) are as follows: Among them, Indicates the normalized adjacency matrix; W(l) represents the weight matrix of the l-th graph convolutional network (GCN); The l-th graph convolutional network (GCN) represents the first graph convolutional network (GCN), the second graph convolutional network (GCN), or the third graph convolutional network (GCN); σ represents the activation function; H (l) represents the output spatial structure features of the l-th graph convolutional network GCN; H (l+1) Represents the output spatial structure features of the (l + 1)-th graph convolutional network (GCN).

8. An intelligent detection method for detecting cross-site scripting attacks according to claim 7, characterized in that: In Step 4222, feature clustering of the node features is performed based on the density-based spatial clustering of applications with noise (DBSCAN) algorithm. After the clustering is completed, each node will be assigned a clustering label; The specific process is as follows: 1). Initialize all the node features obtained in Step 4221 as unvisited feature points; 2). Set the neighborhood radius ε; Check the neighborhood centered at the current feature point with a radius of ε; 3). If the number of feature points in the neighborhood is greater than or equal to minPts, the feature points in the neighborhood are grouped into the same cluster; minPts is the set minimum number of samples; 4). If the above conditions are not met, the points in the neighborhood are marked as noise points and do not participate in the graph structure construction; Among them, the neighborhood radius calculation formula is as follows: dist(p,q) ≤ ε Among them, dist(p,q) represents the distance between feature point p and feature point q; p and q are any two feature points among all the feature points obtained in 1); p i represents the value of the i-th dimension of the feature point p; q i Represents the value of the i-th dimension of the feature point q; N is the total dimension of each feature point, that is, the total number of all words in the core vocabulary for XSS attack detection.

9. The intelligent detection method for detecting cross-site scripting attacks according to claim 8, wherein: In step 423, the temporal features output by the temporal feature extraction model and the spatial structure features output by the spatial structure feature extraction model are input into the multi-feature fusion model, and the multi-feature fusion model outputs fused features. The specific process is as follows: 1), The temporal features output by the temporal feature extraction model are input into the normalization network, and the normalization network outputs the temporal feature projection matrix; expressed as: Where, W1, W2, W3 are the weight matrices of the self-normalization network; b1, b2, b3 are the bias terms of the self-normalization network; h T represents a timing characteristic; W T represents a temporal feature projection matrix; SELU and tanh are activation functions; 2), The spatial structure features output by the spatial structure feature extraction model are input into the normalization network, and the normalization network outputs the spatial structure feature projection matrix; expressed as: Where, W1, W2, W3 are the weight matrices of the self-normalization network; b1, b2, b3 are the bias terms of the self-normalization network; h G represents a spatial structure feature; W G represents a projection matrix of spatial structure features; Denote intermediate variables; SELU and tanh are activation functions; 3), based on the temporal feature h T Obtain the adaptive feature weight α T ; Based on the spatial structure feature h G Obtain the adaptive feature weight α of the spatial structure feature G ; The specific calculation process is as follows: α T = fα T (h T ), α G = fα G (h G ) Where, fα T represents the temporal feature adaptive weight adjustment network, fα G represents the spatial structure feature adaptive weight adjustment network; α T represents the adaptive feature weight for temporal characteristics, α G represents the adaptive feature weight for spatial structure characteristics; The temporal feature adaptive weight adjustment network is a multi-layer perceptron MLP; The spatial structure feature adaptive weight adjustment network is a multi-layer perceptron MLP; 4), based on the adaptive feature weight α T , the temporal feature projection matrix W T , adjust the temporal feature h T to obtain the adjusted temporal feature which is expressed as: Adaptive Feature Weight α Based on Spatial Structure Features G , Spatial Structure Feature Projection Matrix W G , adjust the spatial structure feature h G to obtain the adjusted spatial structure feature which is expressed as: The adjusted temporal feature is concatenated with the adjusted spatial structure feature to generate the final fused feature vector h fused ; which is expressed as:

10. An intelligent detection method for detecting cross-site scripting attacks according to claim 9, characterized in that: In step 424, the fused feature vector is input into the XSS attack detector, and the XSS attack detector outputs the predicted classification result. The specific process is as follows: The fused feature vector h fused is successively input into the first fully connected layer, the second fully connected layer, the linear layer, and the Sigmoid activation function layer. The Sigmoid activation function layer outputs the classification prediction result to determine whether the input sample belongs to an XSS attack; The calculation formula is as follows: Where, and are the weight matrices of the first fully-connected layer and the second fully-connected layer, respectively; and are the bias terms of the first fully connected layer and the second fully connected layer respectively; Indicates the final XSS classification prediction result; W fc is the weight matrix of the linear layer, and b fc is the bias term of the linear layer; Sigmoid is the Sigmoid activation function; ReLU is the ReLU activation function; h fc1 represents the output features of the first fully-connected layer; h fc2 Represents the output features of the second fully connected layer.

Images