XSS-Dec: A hybrid solution to mitigate cross-site scripting attacks

Smitha Sundareswaran, Anna Squicciarini

Research output: Chapter in Book/Report/Conference proceedingConference contribution

6 Citations (Scopus)

Abstract

Cross-site scripting attacks represent one of the major security threats in today's Web applications. Current approaches to mitigate cross-site scripting vulnerabilities rely on either server-based or client-based defense mechanisms. Although effective for many attacks, server-side protection mechanisms may leave the client vulnerable if the server is not well patched. On the other hand, client-based mechanisms may incur a significant overhead on the client system. In this work, we present a hybrid client-server solution that combines the benefits of both architectures. Our Proxy-based solution leverages the strengths of both anomaly detection and control flow analysis to provide accurate detection. We demonstrate the feasibility and accuracy of our approach through extended testing using real-world cross-site scripting exploits.

Original languageEnglish (US)
Title of host publicationData and Applications Security and Privacy XXVI - 26th Annual IFIP WG 11.3 Conference, DBSec 2012, Proceedings
Pages223-238
Number of pages16
DOIs
StatePublished - Aug 1 2012
Event26th Annual WG 11.3 Conference on Data and Applications Security and Privacy, DBSec 2012 - Paris, France
Duration: Jul 11 2012Jul 13 2012

Publication series

NameLecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)
Volume7371 LNCS
ISSN (Print)0302-9743
ISSN (Electronic)1611-3349

Other

Other26th Annual WG 11.3 Conference on Data and Applications Security and Privacy, DBSec 2012
CountryFrance
CityParis
Period7/11/127/13/12

Fingerprint

Servers
Server
Attack
Client/server
Anomaly Detection
Flow Control
Web Application
Vulnerability
Leverage
Flow control
Testing
Demonstrate
Architecture

All Science Journal Classification (ASJC) codes

  • Theoretical Computer Science
  • Computer Science(all)

Cite this

Sundareswaran, S., & Squicciarini, A. (2012). XSS-Dec: A hybrid solution to mitigate cross-site scripting attacks. In Data and Applications Security and Privacy XXVI - 26th Annual IFIP WG 11.3 Conference, DBSec 2012, Proceedings (pp. 223-238). (Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics); Vol. 7371 LNCS). https://doi.org/10.1007/978-3-642-31540-4_17
Sundareswaran, Smitha ; Squicciarini, Anna. / XSS-Dec : A hybrid solution to mitigate cross-site scripting attacks. Data and Applications Security and Privacy XXVI - 26th Annual IFIP WG 11.3 Conference, DBSec 2012, Proceedings. 2012. pp. 223-238 (Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)).
@inproceedings{a6563355b6b348dab57bad27dfe0c753,
title = "XSS-Dec: A hybrid solution to mitigate cross-site scripting attacks",
abstract = "Cross-site scripting attacks represent one of the major security threats in today's Web applications. Current approaches to mitigate cross-site scripting vulnerabilities rely on either server-based or client-based defense mechanisms. Although effective for many attacks, server-side protection mechanisms may leave the client vulnerable if the server is not well patched. On the other hand, client-based mechanisms may incur a significant overhead on the client system. In this work, we present a hybrid client-server solution that combines the benefits of both architectures. Our Proxy-based solution leverages the strengths of both anomaly detection and control flow analysis to provide accurate detection. We demonstrate the feasibility and accuracy of our approach through extended testing using real-world cross-site scripting exploits.",
author = "Smitha Sundareswaran and Anna Squicciarini",
year = "2012",
month = "8",
day = "1",
doi = "10.1007/978-3-642-31540-4_17",
language = "English (US)",
isbn = "9783642315398",
series = "Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)",
pages = "223--238",
booktitle = "Data and Applications Security and Privacy XXVI - 26th Annual IFIP WG 11.3 Conference, DBSec 2012, Proceedings",

}

Sundareswaran, S & Squicciarini, A 2012, XSS-Dec: A hybrid solution to mitigate cross-site scripting attacks. in Data and Applications Security and Privacy XXVI - 26th Annual IFIP WG 11.3 Conference, DBSec 2012, Proceedings. Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics), vol. 7371 LNCS, pp. 223-238, 26th Annual WG 11.3 Conference on Data and Applications Security and Privacy, DBSec 2012, Paris, France, 7/11/12. https://doi.org/10.1007/978-3-642-31540-4_17

XSS-Dec : A hybrid solution to mitigate cross-site scripting attacks. / Sundareswaran, Smitha; Squicciarini, Anna.

Data and Applications Security and Privacy XXVI - 26th Annual IFIP WG 11.3 Conference, DBSec 2012, Proceedings. 2012. p. 223-238 (Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics); Vol. 7371 LNCS).

Research output: Chapter in Book/Report/Conference proceedingConference contribution

TY - GEN

T1 - XSS-Dec

T2 - A hybrid solution to mitigate cross-site scripting attacks

AU - Sundareswaran, Smitha

AU - Squicciarini, Anna

PY - 2012/8/1

Y1 - 2012/8/1

N2 - Cross-site scripting attacks represent one of the major security threats in today's Web applications. Current approaches to mitigate cross-site scripting vulnerabilities rely on either server-based or client-based defense mechanisms. Although effective for many attacks, server-side protection mechanisms may leave the client vulnerable if the server is not well patched. On the other hand, client-based mechanisms may incur a significant overhead on the client system. In this work, we present a hybrid client-server solution that combines the benefits of both architectures. Our Proxy-based solution leverages the strengths of both anomaly detection and control flow analysis to provide accurate detection. We demonstrate the feasibility and accuracy of our approach through extended testing using real-world cross-site scripting exploits.

AB - Cross-site scripting attacks represent one of the major security threats in today's Web applications. Current approaches to mitigate cross-site scripting vulnerabilities rely on either server-based or client-based defense mechanisms. Although effective for many attacks, server-side protection mechanisms may leave the client vulnerable if the server is not well patched. On the other hand, client-based mechanisms may incur a significant overhead on the client system. In this work, we present a hybrid client-server solution that combines the benefits of both architectures. Our Proxy-based solution leverages the strengths of both anomaly detection and control flow analysis to provide accurate detection. We demonstrate the feasibility and accuracy of our approach through extended testing using real-world cross-site scripting exploits.

UR - http://www.scopus.com/inward/record.url?scp=84864346176&partnerID=8YFLogxK

UR - http://www.scopus.com/inward/citedby.url?scp=84864346176&partnerID=8YFLogxK

U2 - 10.1007/978-3-642-31540-4_17

DO - 10.1007/978-3-642-31540-4_17

M3 - Conference contribution

AN - SCOPUS:84864346176

SN - 9783642315398

T3 - Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)

SP - 223

EP - 238

BT - Data and Applications Security and Privacy XXVI - 26th Annual IFIP WG 11.3 Conference, DBSec 2012, Proceedings

ER -

Sundareswaran S, Squicciarini A. XSS-Dec: A hybrid solution to mitigate cross-site scripting attacks. In Data and Applications Security and Privacy XXVI - 26th Annual IFIP WG 11.3 Conference, DBSec 2012, Proceedings. 2012. p. 223-238. (Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)). https://doi.org/10.1007/978-3-642-31540-4_17