Method and device for detecting cross-site scripting attacks
Patent Information
- Application Number
- CN202510338732.X
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-03-21
- Publication Date
- 2026-09-22
AI Technical Summary
然而，这种方式不仅耗时耗力，而且对于恶意攻击检测的准确率较低
[0017]1、由于图卷积神经网络能够捕捉数据之间的特征关联，因此大幅提高了模型的检测可靠性；并且，图由节点及边构成，边上还可以进一步附着信息，因此提高了模型的检测灵活性。由此，本发明通过图卷积神经网络实现跨站脚本的攻击检测，能够直接针对URL进行检测，而无需将URL中的攻击载荷提取出来，避免了实际检测时攻击被绕开而误检的情况，从而可以提高攻击检测的准确率。
Smart Images
Figure CN122802172A_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of Internet data analysis technology, specifically to a method and apparatus for detecting cross-site scripting attacks. Background Technology
[0002] With the continuous development of internet technology, malicious attacks on the network have occurred frequently. In recent years, due to the simplicity and low technical threshold of cross-site scripting (XSS) attacks, a large number of XSS attacks have proliferated on the network. Among them, the most serious is reflected XSS, also known as non-persistent attack. The main attack method is to append some JavaScript language that the server can parse and execute to the URL (Uniform Resource Locator), thereby causing the server to execute the attacker's malicious code.
[0003] Currently, attack detection is performed by extracting features from known cross-site scripting attacks, creating feature sets, and then performing regular expression matching on the URLs. However, this method is not only time-consuming and labor-intensive, but also has a low accuracy rate in detecting malicious attacks. Summary of the Invention
[0004] The purpose of this invention is to solve the problems existing in the prior art and to provide a method and apparatus for detecting cross-site scripting attacks.
[0005] The cross-site scripting (XSS) attack detection method provided by this invention is implemented through the following technical solution: Preprocessing the URL in the input original HTTP request to obtain a decoded URL; segmenting the decoded URL to obtain multiple tokens and constructing a vocabulary, the vocabulary including the multiple tokens and the decoded URL; embedding the vocabulary, converting each token into a one-dimensional vector, and adding the one-dimensional vectors of the tokens associated with the decoded URL to obtain the one-dimensional vector corresponding to the URL; converting the one-dimensional vector corresponding to the URL and the one-dimensional vectors corresponding to each token into graph data, the graph data including nodes and edges, the nodes including each URL and each token, and the edges including edges from URL to token and edges from token to token; training a graph convolutional neural network model based on the graph data to obtain a cross-site scripting attack detection model.
[0006] Furthermore, the method also includes: adding label information to each node in the graph data, wherein the label information of malicious attack URL nodes is 0, the label information of token nodes is 1, and the label information of benign URL nodes is 2; and converting the label information of the nodes into one-hot encoding.
[0007] Furthermore, the method also includes: for the edges from URL to token in the graph data, according to the formula... Calculate the corresponding path similarity metric as the weight value of the edge; where A represents the number of edges from a given URL to a given token, and B represents the number of edges from a given token to non-given URLs.
[0008] Furthermore, the method also includes: for the edges from token to token in the graph data, according to the formula... Calculate the corresponding point mutual information as the weight value of the edge; where p(x,y) is used to characterize the proportion of the xy edge in the edge database of the graph data, and p(x) and p(y) represent the number of times x and y appear in the edge data, respectively.
[0009] Furthermore, the step of training the graph convolutional neural network model based on the graph data to obtain the cross-site scripting (XSS) attack detection model includes: dividing the graph data into training data and validation data using a 10-fold method, wherein the validation data accounts for one-tenth of the graph data; training the model based on the training data, wherein the model is a graph convolutional neural network, and adding a regularization layer and an Adam optimizer to the model; and validating the model based on the validation data until the validation result reaches a preset accuracy threshold, thereby completing the training and obtaining the XSS attack detection model.
[0010] The cross-site scripting (XSS) attack detection device provided by this invention is implemented through the following technical solutions: a preprocessing module preprocesses the URL in the input original HTTP request to obtain a decoded URL; a word segmentation module segments the decoded URL to obtain multiple tokens and constructs a vocabulary, which includes the multiple tokens and the decoded URL; an embedding module embeds the vocabulary, converts each token into a one-dimensional vector, and adds the one-dimensional vectors of the tokens related to the decoded URL to obtain the one-dimensional vector corresponding to the URL; a graph construction module converts the one-dimensional vector corresponding to the URL and the one-dimensional vectors corresponding to each token into graph data, which includes nodes and edges, where each node includes each URL and each token, and each edge includes edges from URL to token and edges from token to token; and a training module trains a graph convolutional neural network model based on the graph data to obtain a cross-site scripting attack detection model.
[0011] Furthermore, the device also includes: a tag module, used to add tag information to each node in the graph data, wherein the tag information of a malicious attack URL node is 0, the tag information of a token node is 1, and the tag information of a benign URL node is 2; and the tag information of the nodes is converted into one-hot encoding.
[0012] Furthermore, the device also includes: a calculation module, used to calculate the edges from URL to token in the graph data according to the formula. Calculate the corresponding path similarity metric as the weight value of the edge; where A represents the number of edges from a given URL to a given token, and B represents the number of edges from a given token to non-given URLs.
[0013] Furthermore, the calculation module is also used to perform calculations on edges from token to token in the graph data.
[0014] Where p(x,y) is used to characterize the proportion of edge xy in the edge database of graph data, and p(x) and p(y) represent the number of times x and y appear in the edge data, respectively.
[0015] Furthermore, the training module includes: a partitioning submodule, used to divide the graph data into training data and validation data using a 10-fold method, wherein the validation data accounts for one-tenth of the graph data; a training submodule, used to train the model based on the training data, wherein the model is a graph convolutional neural network, and a regularization layer and an Adam optimizer are added to the model; and a validation submodule, used to validate the model based on the validation data until the validation result reaches a preset accuracy threshold, at which point training is complete, and the cross-site scripting attack detection model is obtained.
[0016] Compared with the prior art, the beneficial effects of the present invention include:
[0017] 1. Because graph convolutional neural networks can capture the feature relationships between data, they significantly improve the detection reliability of the model. Furthermore, graphs are composed of nodes and edges, and information can be further attached to the edges, thus increasing the detection flexibility of the model. Therefore, this invention uses graph convolutional neural networks to detect cross-site scripting attacks, directly targeting the URL without extracting the attack payload from the URL. This avoids false positives due to attacks being bypassed during actual detection, thereby improving the accuracy of attack detection.
[0018] 2. This invention segments the cross-site scripting URL containing the attack payload into multiple keyword tokens. At the same time, it uses the Word2Vec method to vectorize the features of the tokens and URLs. Since the URLs of cross-site scripting attacks have obvious similarities, the path similarity metric is used as the relevant weight in the graph convolutional neural network, which can improve the detection performance of the model.
[0019] 3. This invention calculates the mutual information between points as the edge weight between tokens, making full use of the information between each token in the URL, improving the utilization rate of the information itself, and thus further improving the accuracy of attack detection. Attached Figure Description
[0020] Figure 1 This is a schematic diagram of the cross-site scripting attack detection method in this specific implementation.
[0021] Figure 2 This is another flowchart illustrating the cross-site scripting attack detection method in this specific embodiment;
[0022] Figure 3 This is a schematic diagram of the cross-site scripting attack detection device in this specific embodiment;
[0023] Figure 4 This is another structural schematic diagram of the cross-site scripting attack detection device in this specific embodiment;
[0024] Figure 5 This is a schematic diagram of the training module in this specific embodiment. Detailed Implementation
[0025] The present invention will now be described in further detail with reference to the accompanying drawings:
[0026] refer to Figure 1 As shown, the cross-site scripting attack detection method in this specific embodiment includes:
[0027] 101. Preprocess the URL in the original HTTP request to obtain the decoded URL.
[0028] In this embodiment of the invention, the input is the original HTTP request URL. If the request is a cross-site scripting (XSS) attack, the attacker typically encodes the attack payload (e.g., HTML entity encoding, base64 encoding, URL encoding, or case obfuscation) to bypass the website's defense mechanisms. In this embodiment of the invention, through preprocessing, the URL can be decoded according to the encoding rules to obtain the original attack payload.
[0029] 102. Perform word segmentation on the decoded URL to obtain multiple tokens, and construct a vocabulary that includes the multiple tokens and the decoded URL.
[0030] In this embodiment of the invention, the preprocessed URL is tokenized according to certain rules, and a vocabulary is constructed, in which the URL is also added; at the same time, a dictionary is constructed that maps each element in the vocabulary to its index.
[0031] In the embodiments of the present invention, URL word segmentation can be achieved through a fully automated method in the field of natural language processing, which can reduce the cost of word segmentation.
[0032] 103. Embed the vocabulary, convert each token into a one-dimensional vector, and add the one-dimensional vectors of the tokens related to the decoded URL to obtain the one-dimensional vector corresponding to the URL.
[0033] Next, the contents of the vocabulary are embedded using the Word2Vec method, and the tokens are converted into one-dimensional vectors. Then, according to the vocabulary, the vectors of the tokens related to each URL are summed to form the vector of that URL.
[0034] 104. Convert the one-dimensional vector corresponding to the URL and the one-dimensional vector corresponding to each token into graph data. The graph data includes nodes and edges. The nodes include each URL and each token. The edges include edges from URL to token and edges from token to token.
[0035] 105. Train the graph convolutional neural network model based on the graph data to obtain a cross-site scripting attack detection model.
[0036] Compared with existing technologies, in this embodiment of the invention, the graph convolutional neural network can capture the feature relationships between data, thus significantly improving the detection reliability of the model; furthermore, the graph is composed of nodes and edges, and information can be further attached to the edges, thereby improving the detection flexibility of the model. Therefore, this embodiment of the invention achieves cross-site scripting attack detection through graph convolutional neural networks, enabling direct detection of the URL without extracting the attack payload from the URL, avoiding false detections due to attacks being bypassed during actual detection, and thus improving the accuracy of attack detection.
[0037] refer to Figure 2 As shown, another method for detecting cross-site scripting attacks in this specific embodiment includes:
[0038] 201. Preprocess the URL in the original HTTP request to obtain the decoded URL.
[0039] In this embodiment of the invention, the input is the original HTTP request URL. If the request is a cross-site scripting (XSS) attack, the attacker typically encodes the attack payload (e.g., HTML entity encoding, base64 encoding, URL encoding, or case obfuscation) to bypass the website's defense mechanisms. In this embodiment of the invention, through preprocessing, the URL can be decoded according to the encoding rules to obtain the original attack payload.
[0040] 202. Perform word segmentation on the decoded URL to obtain multiple tokens, and construct a vocabulary, which includes the multiple tokens and the decoded URL.
[0041] In this embodiment of the invention, the preprocessed URL is tokenized according to certain rules, and a vocabulary is constructed, in which the URL is also added; at the same time, a dictionary is constructed that maps each element in the vocabulary to its index.
[0042] In the embodiments of the present invention, URL word segmentation can be achieved through a fully automated method in the field of natural language processing, which can reduce the cost of word segmentation.
[0043] 203. Embed the vocabulary, convert each token into a one-dimensional vector, and add the one-dimensional vectors of the tokens related to the decoded URL to obtain the one-dimensional vector corresponding to the URL.
[0044] Next, the contents of the vocabulary are embedded using the Word2Vec method, and the tokens are converted into one-dimensional vectors. Then, according to the vocabulary, the vectors of the tokens related to each URL are summed to form the vector of that URL.
[0045] 204. Convert the one-dimensional vector corresponding to the URL and the one-dimensional vector corresponding to each token into graph data.
[0046] The graph data includes nodes and edges. Each node includes URLs and tokens, and each edge includes edges from URLs to tokens and edges from tokens to tokens. In this embodiment, the one-dimensional vectors corresponding to URLs and tokens are the vectorized URLs and vectorized tokens, respectively.
[0047] 205. Add label information to each node in the graph data.
[0048] In this embodiment, the label information of malicious attack URL nodes is 0, the label information of token nodes is 1, and the label information of benign URL nodes is 2. For this embodiment, the label information of the above nodes can be further converted into one-hot encoding.
[0049] 206. For the edges from URL to token in the graph data, according to the formula... Calculate the corresponding path similarity metric, which serves as the weight value for the edge.
[0050] Where A represents the number of edges from a given URL to a given token, and B represents the number of edges from a given token to non-given URLs.
[0051] In this embodiment of the invention, the cross-site scripting URL containing the attack payload is segmented into multiple keyword tokens. At the same time, the features of the tokens and URLs are vectorized based on the Word2Vec method. Since the URLs of cross-site scripting attacks have obvious similarities, the path similarity metric is used as the relevant weight in the graph convolutional neural network, which can improve the detection performance of the model.
[0052] 207. For the edges between tokens in the graph data, according to the formula... Calculate the mutual information of the corresponding points, which is used as the weight value of the edge.
[0053] Where p(x,y) is used to characterize the proportion of edge xy in the edge database of graph data, and p(x) and p(y) represent the number of times x and y appear in the edge data, respectively.
[0054] In this embodiment of the invention, the edges from one token to another are determined by the tokenization result of the URL. For example, if the tokenization result of the URL is [A,B,C,D], then the three edges AB, BC, and CD will be generated in sequence. In this case, the edge weight for this type is pointwise mutual information (PMI). By traversing all edges from one token to another to form a database, the number of times the specified edge appears in the database is divided by the total number of edges in the database to determine whether the two node tokens of that edge are strongly linked.
[0055] In this embodiment of the invention, by calculating the mutual information between points as the edge weight between tokens, the information between each token in the URL is fully utilized. Natural language processing is adopted to improve the utilization rate of the information itself, thereby further improving the accuracy of attack detection.
[0056] 208. Using a 10-fold method, the graph data is divided into training data and validation data, wherein the validation data accounts for one-tenth of the graph data.
[0057] In this embodiment of the invention, the 10-fold method divides the training data into 10 parts, of which 9 parts are used for training and 1 part is used for verification.
[0058] 209. Train the graph convolutional neural network model based on the training data, and add a regularization layer and an Adam optimizer to the graph convolutional neural network model.
[0059] In this embodiment of the invention, the model uses a graph convolutional neural network with a three-layer network structure. A regularization layer (dropout) is added between every two network layers to prevent overfitting. The model also uses the Adam optimizer, which can set the learning rate to 0.01 and nll loss (negative log likelihood loss).
[0060] 210. Validate the model based on the validation data until the validation result reaches the preset accuracy threshold. Training is then complete, and the cross-site scripting attack detection model is obtained.
[0061] For example, in this embodiment of the invention, the accuracy threshold is set to 99%, meaning that an accuracy of over 99% is achieved on a 10-fold validation set, at which point the model training is considered complete. Specifically, the true positive rate can be set to 99.36%, the false positive rate to 00.00%, the true negative rate to 98.73%, and the false negative rate to 00.48%. A true positive refers to a case where the actual class is positive and the model predicts it as positive; a true negative refers to a case where the actual class is negative and the model predicts it as negative; a false positive refers to a case where the actual class is negative but the model incorrectly predicts it as positive; and a false negative refers to a case where the actual class is positive but the model incorrectly predicts it as negative. In this embodiment of the invention, by specifically setting the evaluation criteria for true positive rate, false positive rate, true negative rate, and false negative rate, the binary classification performance of the model can be clearly and accurately reflected.
[0062] Compared with existing technologies, in this embodiment of the invention, the graph convolutional neural network can capture the feature relationships between data, thus significantly improving the detection reliability of the model; furthermore, the graph is composed of nodes and edges, and information can be further attached to the edges, thereby improving the detection flexibility of the model. Therefore, this embodiment of the invention achieves cross-site scripting attack detection through graph convolutional neural networks, enabling direct detection of the URL without extracting the attack payload from the URL, avoiding false detections due to attacks being bypassed during actual detection, and thus improving the accuracy of attack detection.
[0063] refer to Figure 3 As shown, the cross-site scripting attack detection device of this specific embodiment includes:
[0064] The preprocessing module 31 preprocesses the input raw HTTP request URL to obtain the decoded URL data.
[0065] The word segmentation module 32 is used to segment the preprocessed URL to obtain multiple tokens and construct a vocabulary, which includes the multiple tokens and the URL.
[0066] Embedding module 33 embeds the vocabulary into a representation, converts each token into a one-dimensional vector, and adds the one-dimensional vectors of the URL-related tokens to obtain the one-dimensional vector of the URL.
[0067] Graph construction module 34 converts vectorized URLs and tokens into graph data, wherein the graph data includes nodes and edges, the nodes include each URL and each token, and the edges include edges from URL to token and edges from token to token.
[0068] Training module 35 is used to train a graph convolutional neural network model based on the graph data to obtain a cross-site scripting attack detection model.
[0069] refer to Figure 4 As shown, the device further includes: a tag module 41 and a calculation module 42.
[0070] The tag module 41 is used to add tag information to each node in the graph data, wherein the tag information of the malicious attack URL node is 0, the tag information of the token node is 1, and the tag information of the benign URL node is 2; and the tag information of the node is converted into one-hot encoding.
[0071] Calculation module 42 is used to calculate the edges from URL to token in the graph data according to the formula. Calculate the corresponding path similarity metric as the weight value of the edge; where A represents the number of edges from a given URL to a given token, and B represents the number of edges from a given token to non-given URLs.
[0072] The calculation module 42 is further configured to, for the edges from token to token in the graph data, calculate according to the formula Calculate the corresponding point mutual information as the weight value of the edge; where p(x,y) is used to characterize the proportion of the xy edge in the edge database of the graph data, and p(x) and p(y) represent the number of times x and y appear in the edge data, respectively.
[0073] refer to Figure 5 As shown, the training module 35 further includes: a partitioning submodule 3501, a training submodule 3502, and a verification submodule 3503.
[0074] The partitioning submodule 3501 is used to divide the graph data into training data and validation data in a 10-fold manner, wherein the validation data accounts for one-tenth of the graph data.
[0075] The training submodule 3502 is used to train the model based on the training data. The model is a graph convolutional neural network, and a regularization layer and an Adam optimizer are added to the model.
[0076] The verification submodule 3503 is used to verify the model based on the verification data until the verification result reaches the preset accuracy threshold, the training is completed, and the cross-site script attack detection model is obtained.
[0077] The cross-site scripting attack detection device provided in this specific embodiment can implement the method implementation method described above. For specific functional implementation, please refer to the description in the method embodiment, which will not be repeated here.
[0078] The above technical solution is only one embodiment of the present invention. For those skilled in the art, based on the principles disclosed in the present invention, it is easy to make various types of improvements or modifications, and not limited to the technical solutions described in the specific embodiments of the present invention. Therefore, the foregoing description is only preferred and not restrictive.
Claims
1. A method for detecting cross-site scripting attacks, characterized in that, include: The URL in the original HTTP request is preprocessed to obtain the decoded URL; The decoded URL is segmented to obtain multiple tokens, and a vocabulary is constructed, which includes the multiple tokens and the decoded URL. The vocabulary is embedded and represented, each token is converted into a one-dimensional vector, and the one-dimensional vectors of tokens related to the decoded URL are added together to obtain the one-dimensional vector corresponding to the URL. The one-dimensional vector corresponding to the URL and the one-dimensional vector corresponding to each token are converted into graph data. The graph data includes nodes and edges. The nodes include each URL and each token. The edges include the edges from the URL to the token and the edges from the token to the token. A cross-site scripting (XSS) attack detection model is obtained by training a graph convolutional neural network model based on the graph data.
2. The cross-site scripting attack detection method according to claim 1, characterized in that, The method further includes: Add label information to each node in the graph data, wherein the label information of malicious attack URL nodes is 0, the label information of token nodes is 1, and the label information of benign URL nodes is 2. Convert the node's label information into one-hot encoding.
3. The cross-site scripting attack detection method according to claim 1, characterized in that, The method further includes: For the edges from URL to token in the graph data, according to the formula Calculate the corresponding path similarity metric as the weight value of the edge; where A represents the number of edges from a given URL to a given token, and B represents the number of edges from a given token to non-given URLs.
4. The cross-site scripting attack detection method according to claim 1, characterized in that, The method further includes: For the edges between tokens in the graph data, according to the formula Calculate the corresponding point mutual information as the weight value of the edge; where p(x,y) is used to characterize the proportion of the xy edge in the edge database of the graph data, and p(x) and p(y) represent the number of times x and y appear in the edge data, respectively.
5. The cross-site scripting attack detection method according to claim 1, characterized in that, The process of training a graph convolutional neural network model based on the graph data to obtain a cross-site scripting (XSS) attack detection model includes: The graph data is divided into training data and validation data using a 10-fold method, with the validation data accounting for one-tenth of the graph data. The model is trained based on the training data. The model is a graph convolutional neural network. A regularization layer and an Adam optimizer are added to the model. The model is validated based on the validation data until the validation result reaches the preset accuracy threshold, and the training is completed, thus obtaining the cross-site scripting attack detection model.
6. A cross-site scripting attack detection device, characterized in that, include: The preprocessing module preprocesses the URL in the original HTTP request to obtain the decoded URL; The word segmentation module performs word segmentation on the decoded URL to obtain multiple tokens and constructs a vocabulary, which includes the multiple tokens and the decoded URL. The embedding module embeds the vocabulary, converts each token into a one-dimensional vector, and adds the one-dimensional vectors of tokens related to the decoded URL to obtain the one-dimensional vector corresponding to the URL. The graph construction module converts the one-dimensional vector corresponding to the URL and the one-dimensional vector corresponding to each token into graph data. The graph data includes nodes and edges. The nodes include each URL and each token. The edges include edges from URL to token and edges from token to token. The training module trains the graph convolutional neural network model based on the graph data to obtain a cross-site scripting attack detection model.
7. The cross-site scripting attack detection device according to claim 6, characterized in that, The device further includes: The tag module is used to add tag information to each node in the graph data, wherein the tag information of malicious attack URL nodes is 0, the tag information of token nodes is 1, and the tag information of benign URL nodes is 2; the tag information of the nodes is converted into one-hot encoding.
8. The cross-site scripting attack detection device according to claim 6, characterized in that, The device further includes: The calculation module is used to calculate the edges from URL to token in the graph data according to the formula. Calculate the corresponding path similarity metric as the weight value of the edge; where A represents the number of edges from a given URL to a given token, and B represents the number of edges from a given token to non-given URLs.
9. The cross-site scripting attack detection device according to claim 6, characterized in that, The calculation module is also used to calculate the edges from token to token in the graph data according to the formula. Calculate the corresponding point mutual information as the weight value of the edge; where p(x,y) is used to characterize the proportion of the xy edge in the edge database of the graph data, and p(x) and p(y) represent the number of times x and y appear in the edge data, respectively.
10. The cross-site scripting attack detection device according to claim 6, characterized in that, The training module includes: The partitioning submodule is used to divide the graph data into training data and validation data in a 10-fold manner, wherein the validation data accounts for one-tenth of the graph data. The training submodule is used to train the model based on the training data. The model is a graph convolutional neural network. A regularization layer and an Adam optimizer are added to the model. The verification submodule is used to verify the model based on the verification data until the verification result reaches the preset accuracy threshold, the training is completed, and the cross-site scripting attack detection model is obtained.