XSS adversarial example attacks based on deep reinforcement learning. Issue 120 (September 2022)

• Record Type: Journal Article
• Authors: Chen, Li; Tang, Cong; He, Junjiang; Zhao, Hui; Lan, Xiaolong; Li, Tao
• Is Part Of: Computers & security. Issue 120(2022)
• Publication Date: 2022-09
• Subjects: Web security -- Cross site scripting -- Adversarial examples -- Adversarial attack -- SAC -- Reinforcement learning; Computer security -- Periodicals; Electronic data processing departments -- Security measures -- Periodicals; 005.805
• DOI: 10.1016/j.cose.2022.102831
• Languages: English
• ISSNs: 0167-4048

Abstract

Abstract: Cross-site scripting (XSS) attack is one of the most serious security problems in web applications. Although deep neural network (DNN) has been used in XSS attack detection and achieved unprecedented success, it is vulnerable to adversarial example attacks because its input-output mapping is quite discontinuous to a large extent. The existence of adversarial examples have raised concerns in applying deep learning to key security fields. Therefore, to evaluate the effectiveness of these detection methods, a XSS adversarial example attack technique using Soft Actor-Critic (SAC) reinforcement learning algorithm is presented in the paper. A key aspect of our idea is to train an agent using SAC algorithm to build adversarial examples for several popular XSS detection models which have been proved can achieve very high accuracy rate by simulation experiments. We first design mutation strategies for different modules of XSS attack vectors to ensure the validity of the generated adversarial examples. Then, the agent selects an appropriate escape strategy according to the feedback of the detection model until it bypasses the detection model. The final experiment results show that our model can achieve an escape rate of more than 92% and outperforms the latest method by up to 6%. In other words, the effectiveness of these detection models needs to be improved, at least in terms of defense adversarial example attacks.