# Machine Learning for Detection and Mitigation of Web Vulnerabilities and Web
Attacks

Mahnoor Shahid  Universität des Saarlandes
Saarland, Saarbrücken, Germany
<EMAIL_ADDRESS>
###### Abstract

Detection and mitigation of critical web vulnerabilities and attacks like
cross-site scripting (XSS), and cross-site request forgery (CSRF) have been a
great concern in the field of web security [1]. Such web attacks are evolving
and becoming more challenging to detect. Several ideas from different
perspectives have been put forth that can be used to improve the performance
of detecting these web vulnerabilities and preventing the attacks from
happening [2]. Machine learning techniques have lately been used by
researchers to defend against XSS and CSRF [3], [4], [5], and given the
positive findings, it can be concluded that it is a promising research
direction. The objective of this paper is to briefly report on the research
works that have been published in this direction of applying classical and
advanced machine learning to identify and prevent XSS and CSRF. The purpose of
providing this survey is to address different machine learning approaches that
have been implemented, understand the key takeaway of every research, discuss
their positive impact and the downsides that persists, so that it can help the
researchers to determine the best direction to develop new approaches for
their own research and to encourage researchers to focus towards the
intersection between web security and machine learning.

###### Index Terms:

Web Security; Web Vulnerabilities; Machine Learning; XSS attacks; CSRF attacks

##  1 Introduction

Web applications have become a staple of our daily lives due to their
widespread use in fields such as banking, finance, marketing, taxation, social
interaction, and even medical. Many crucial operations are carried out online
on the web that includes data which could be personal details like
identification information, passwords, pin or pass codes, medical details or
financial details like transactions, purchase details, tax filings etc.
Although, web applications do provide security and safety measures for
protection, there exists some web vulnerabilities which are loopholes, bugs or
voids that are exploited, by an adversary, either on client side or server
side. Indeed, the number of reported web vulnerabilities [6],[7] and the
frequency of web based attacks [8] have been significantly rising each day,
necessitating the critical need for stronger security. However, web
applications, are extremely complicated and challenging to analyze because of
the various complex programming techniques that are used to develop them.
Therefore, identifying those web vulnerabilities is not a straight forward
task and is one of the critical component of a web application’s defense.

Cross-site Scripting (XSS) and cross-site request forgery (CSRF) are
considered to be among the top severe risks to web security from the kinds of
vulnerabilities demonstrated by web applications, as per OWASP Top Ten (Open
Web Application Security Project) [1]. Many detection algorithms based on
conventional techniques, have been provided in order to track down these web
vulnerabilities and defend against these attacks [2]. Unfortunately, they are
not sufficiently effective enough against a threat that can take any form and
is evolving as time passes by. So, another critical component of a web
application’s defense is to detect mischievous and carefully crafted web
attacks by determining whether or not a target script is malicious.

This is where machine learning comes to the rescue. Machine learning (as well
as deep learning) has been widely acknowledged and adopted in many fields to
simplify and automate any highly complicated task, improve its performance,
and increase scalability. Researchers of web security community have also
tried to integrate different machine learning techniques to effectively
identify XSS or CSRF attacks [3], [4], [5] and it has proved to be very
beneficial. This assertion has been validated by the development and
evaluation of many different detection methodologies that has leveraged
machine learning (or deep learning) and have been comprehensively covered in
this paper.

In this paper, various research works are reported and discussed that have
been published in this direction to inspire other researchers to step in this
direction and adopt machine learning or deep learning techniques and use them
to resolve web application threats. The underlining contributions of this
paper can be summarized as follows:

  * •

Provide a concise and systematic literature review of the existing works that
have used machine learning and deep learning procedures to detect and mitigate
XSS web attacks and vulnerabilities.

  * •

Provide a brief overview of the existing works for automating CSRF detection
and the advent of utilizing machine learning for classifying sensitive
requests.

##  2 Cross Site Scripting

Cross-site scripting (XSS) attack[9] is a web attack that is sometimes known
as a code-injection attack in which the attacker inserts malicious code
script, generally JavaScript, around benign code into a legitimate web
application using a weakness (XSS vulnerability) in the web server or in the
user’s browser in order to access cookies, user sessions, and other sensitive
data. This attack can also be exploited to execute other web attacks, like
CSRF, or DOS attack. The Open Source Foundation for Application Security
(OWASP)[10] positions cross-site scripting (XSS) attacks higher on its list of
critical web vulnerabilities.

XSS: attack or vulnerability? XSS vulnerabilities are security bugs, or flaws
in web application that enables the injection of any irregular and harmful
(probably JavaScript) code around innocuous code whereas in XSS attacks, an
adversary takes the advantage and exploits those XSS vulnerabilities in order
to execute the attack by successfully transmitting the malicious code.

###  2.1 Classical machine learning approaches for XSS attacks classification

Initially, researchers have applied classical machine learning strategies to
detect and mitigate XSS that usually involved a feature extraction process
that focuses on specific target attributes to identify XSS attacks. Multiple
classifiers are trained on top of those features using various tactics. Then,
those models are evaluated to observe the impact of the generated features.
The performance of the classifiers are compared and the scores of the best
model are used to conclude the generalization capability of the proposed
procedure. Discussed below are some interesting research articles that have
been published under this umbrella:

Obfuscated malicious JavaScript detection using classification techniques
[2009]
Likarish et al.[11] developed a machine learning strategy to identify
obfuscated malicious JavaScript code snippets. Malicious JavaScript that has
been obfuscated can be used to outwit anti-malware software applications or
manual examination from being detected as malicious and can be inserted in web
pages to spread malware or carry out other unwanted operations. The primary
goal of this study is to identify malicious JavaScript that has been
obfuscated which may be used to carry out XSS attacks. In order to train the
models, they have constructed a dataset which consisted of JavaScript scripts
that belonged to both benign and malicious class. Next, they have focused on
extracting different features manually and settled with a total of 65
features. In the study, features that are extracted are primarily based on
obfuscation methods such encoding, encryption, text/string manipulation, and
eval functions. They have further explored how significantly those features
affect the classification of these malicious scripts. They observed that
malicious JavaScript usually has less proportion of tokens as compared to
benign JavaScript, and their use of JavaScript keywords also varied
significantly. Lastly, they have trained multiple classifiers: SVM, ADTree,
Naive Bayes, and RIPPER for the detection of obfuscation scripts. Ten cycles
of 10-fold cross-validation were used to evaluate the classifiers so they can
assess how much the performance of every classifier varies statistically. The
evaluation results showed that SVM acquired the best precision score=0.92
while JRIP classifier acquired the best recall=0.787 and F2-score=0.806.
Pros \- A novel feature extraction technique has been proposed which was based
on obfuscation methods through which the features set was obtained which was
sufficient to distinguish between JavaScript which is malicious and JavaScript
which is benign. Four distinct classifiers were evaluated in the research, and
found that they are quite accurate. The study offers a number of useful real
world applications for the classifiers, including filtering or examining
dubious JavaScript.
Cons \- Collected dataset was highly imbalanced with 60,000 benign scripts and
only 62 malicious scripts. The test set also consisted of extremely less
obfuscated scripts which is not a good representation of real-world
JavaScript. It also relies on a single source for malicious scripts. Authors
have not clearly defined what constitutes obfuscation or maliciousness in
JavaScript, which can affect the validity and reliability of their labels and
results. They have also not discussed the limitations or challenges of their
approach, such as the trade-off between detection accuracy and performance
overhead, or the ethical implications of suppressing potentially malicious
JavaScript. Another drawback, as addressed by the authors, is that the
classifier would also classify some benign scripts (for e.g., Packed
JavaScript) as malicious causing more false positives.

Classification of malicious web code by machine learning [2011]
Komiya et al[12] adapted machine learning algorithms to identify and
categorize user input that contains malicious web code such as SQL injection
attacks and XSS attacks. In their research, they have proposed two feature
extraction strategies: blank separation (clear partition), and tokenization.
The premise of the first strategy was that a document is made up of several
terms/phrases that are separated by spaces. Therefore, terms were extracted by
splitting the input using blank spaces and the frequency count of every term
was used for the calculation of feature weightage. The second strategy was
predicated on the notion that malicious web code includes particular tokens
that describe its characteristics. Those terms were extracted from the input
using the specified set of tokens and the frequency count of every token term
was again used to calculate feature weights. Afterwards, they have trained and
evaluated SVM, Naive-Bayes, and KNN for detecting exploitable user inputs.
They have also evaluated different types of kernel functions in SVM like
Linear, Polynomial, and Gaussian. The highest accuracy, precision as well as
recall, was achieved by using these feature extraction techniques along with
SVM and Gaussian Kernel.
Pros \- Proposed feature extraction techniques were very effective and it is
reflected in the consistency between the accuracy scores of all the
classifiers. Comparison and evaluation was done using three different machine
learning methods on a large and diverse dataset of web codes.
Cons \- Note that, an inaccurate feature weight might result from phrases or
terms being separated in a malicious script by characters other than white
spaces. This approach may not be effective against new or unknown types of
malicious web code that were not in the dataset. Training and testing the
machine learning models on big datasets could take a lot of computing time and
resources.

Defending Malicious Script Attacks Using Machine Learning Classifiers [2017]
Khan et al.[17] have focused on a real-time, lightweight system with
negligible runtime overheads to defend the end user from being attacked by any
injurious JavaScript code. In the proposed approach, an interceptor was
installed on the web browser of the user as a plugin. Whenever a user sends
any web request to the web server to look up for the requested webpage, the
server in return generates a response which was directed towards the
interceptor which extracts features from web page’s source code and feeds it
to the trained ML classifier for the classification process. If there was any
presence of malicious JavaScript script, the webpage would be banned prior to
the web browser interpreting it. Authors have considered training multiple
binary classifiers (SVM, J48, KNN and Naive Bayes,) on a subset of relevant
features in order to acquire high accuracy and these classifiers were
independently tested and the one with the best performance was selected to be
used in the interceptor. According the to the findings reported in the paper,
three sets of experiments were conducted, keeping some variations in the
training procedures and it was observed that the KNN classifier was able to
acquire 90.70% precision rate and demonstrated better results in all the
experiments in identifying XSS, compared to the other classifiers.
Pros \- Proposed solution is lightweight in design, with little runtime
overheads. It is platform and browser agnostic.
Cons \- Collected dataset was comprised of very few malicious samples.
Precision can be further improved.

Detecting Cross-Site Scripting Attacks Using Machine Learning [2018]
Meerani et al[18] have also considered utilizing machine learning methods to
identify XSS attacks by analyzing HTTP requests and preferred to train SVM,
KNN and Random Forests for XSS attacks detection. This was the first time
Random Forest was considered for XSS classification. They have proposed a way
to come up with a feature set that combines the program syntax and program
behavioral features. They settled with a total of 59 features. They have
investigated and explored how such features have contributed and have led the
classifiers to acquire higher accuracy on real world dataset. They have
compiled a collection of dataset from multiple sources that has balanced
scripts and gives both injurious and benign scripts enough coverage. After
conducting the experiments on the test set, it was concluded that the
classifiers were successfully able to distinguish between the malicious and
benign scripts with high precision and accuracy. Among the trained
classifiers, it was observed that, with a precision of a 96.79%, k-NN
outperformed SVM and Random Forest by a little margin.
Pros \- Extracted feature set were discriminative enough and had a significant
impact/influence over the classifiers’ performance. This can be validated by
the consistent scores of all the trained classifiers. Moreover, models were
trained and evaluated on a very large and diverse dataset, consisting of many
malicious samples.
Cons \- It’s possible that the input will just be plain text and not even be a
script. First-round testing revealed that simple text was not always
appropriately categorized.

Preventing Cross-Site Scripting Attacks by Combining Classifiers [2019]
Meerani et al[19] have extended their previous work to further improve the
performance XSS detection task by combining the classifiers in two ways.
First, by stacking the models together using the ensemble technique and
second, by building a two stage classifier using the cascading technique. In
this research, they have considered five different classifiers, including a
neural network to perform the XSS classification. A stacked classifier is
developed using these five classifiers as base because such a classifier gives
more accurate and robust predictions. A decision tree is also trained from
classifying if the input is a plain text or a script. And using both the
classifiers together, another cascading classifier is developed to verify user
input into a web application. The suggested methodology has two phases. In the
first phase, a decision tree evaluates whether the input is a script or plain
text. Results of this first classifier (samples that are classified as
scripts) are utilized in the subsequent phase where multiple base classifiers
(SVM, KNN, Neural Networks, and Random Forest) were trained to predict whether
the script is malicious or not. To train the decision tree, dataset consisting
of normal and scripts were collected. Text type features were obtained from
them which includes attributes like, letters, numbers, spaces, punctuation
etc. To train the classifiers of second phase, another labelled dataset was
collected, with the script features (same as their previous work, but with
some additional improvement) and using the output of these classifier, the
meta classifier on top of it is trained.
Pros \- Improved feature set along with the stacking of base classifiers,
yielded results that were more accurate as compared to their previous work.
Cascading catered the problem of plain text not being correctly classified.
Cons \- Still there were some malicious scripts that were misclassified
because of base64 encryption that employs letters more frequently as compared
to number or symbols.
Comparision with the previous study \- With the exception of precision, all of
the metrics favors the method proposed in the 2019 study as compared to 2018
study. This implies that while the method in the 2019 study can detect more
XSS attacks and prevent more false negatives than the approach of 2018 study,
it also causes more false positives.

The Detecting Cross-Site Scripting (XSS) Using Machine Learning Methods [2020]
Kascheev et al.[20] presented an XSS attacks detection model by analyzing HTTP
requests and responses using machine learning. In this work, authors have
constructed a dataset of 240,000 JavaScript samples that was comprised of both
malicious (40,000) and benign (200,000) samples. In the pre-processing stage,
data was transformed in the form queries with respective parameters. They have
deciphered the entire dataset into ascii feature vectors and used regular
expressions to extract the parameters. They have discarded the queries that
had a lot of parameters. Then, a dictionary of approximately 3000 tokens was
put together. The feature vectors were created by transforming the dataset
using the word2vec technique. For training the models, they have considered
the classifiers: SVM, Naive Bayes, Logistic Regression, and Decision tree.
They have conducted the experiments to assess the performance of their
suggested approach. They have split the whole dataset into two splits train
set (consisting of 70% of the whole dataset) and test set (remaining 30% of
the whole dataset). They have trained the model using the trainset and
evaluated the performance of the classifiers on the test set. The accuracy
acquired by Decision tree is 98.81%, Naive Bayes Classifier is 65.27%,
Logistic Regression is 83.03%, and is 71.37%.
Pros – A sizable and varied dataset of XSS payloads is used to compare various
machine learning methods and to evaluate their effectiveness. It shows that
the suggested approach can identify XSS attacks with good accuracy and high
recall rates. Another key advantage of this approach, as stated by the
authors, is that a single classifier can consider all the data at once and
also contribute to the production of new data.
Cons \- There was severe class imbalance. However, sample weighting was
performed in the pre-processing phases, and it may have helped to balance the
classes. Disconsistency between the accuracy of the classifiers reflects that
the feature generation process should be improved.

###  2.2 Classical machine learning approaches for XSS vulnerability
classification

Researchers have also applied classical machine learning strategies to detect
XSS vulnerabilities or web pages that are vulnerable to XSS attacks.
Followings are some of the works under this category:

Automatic classification of cross-site scripting in web pages using document-
based and URL-based features [2012]
Nunan et al.[13] have extended the approach of Likarish et al[11] and have
focused on XSS vulnerability classification, as it aims to automatically
classify web pages that are vulnerable to XSS attacks using machine learning
techniques by extracting and analyzing predictive set of features that are
based on URL-based and Document-based attributes. The have compiled a dataset
of 216,054 samples. Out of which, 15,366 samples were malicious and were
obtained from XSSed dataset whereas, benign samples were obtained from Dmoz
and ClueWeb09. They have extracted the features and categorized them into
three groups: obfuscation based (same as Likarish et al[11]), suspicious
patterns, and HTML/JavaScript schemes They have selected two machine learning
classifiers, that is SVM and Naïve Bayes. After training those classifiers,
the have evaluated the performance of the classifiers under three aspects:
rate of false alarms, accuracy or precision, and detection. With a 98 percent
accuracy rate for XSS classification, SVM classifier had the best overall
performance, although Naive Bayes classifier also had satisfactory performance
that was comparable to SVM.
Pros \- Eight alternative machine learning algorithms are compared in the
study with this technique, demonstrating the reliability and universality of
its features. Accuracy and performance have increased with the enhanced set of
features as validated by a quick comparison of performances with the features
mentioned by Likarish et al.[11].
Cons \- This technique may be quite accurate, however it only uses one source
for malicious scripts. The research does not address the computational
complexity or scalability of its methodology, which may have an impact on its
applicability and effectiveness in real-world circumstances.

Machine Learning Based Cross-Site Scripting Detection in Online Social Network
[2014]
Wang R. et al.[14] developed a machine learning strategy to identify XSS in
social networks. They have extracted features related to online social
network, from the web pages and grouped them into four categories: HTML tag
features, JavaScript features, keyword features, and URL features They have
built a database that consisted of 29,046 benign web pages from DMOZ, 13,935
XSS vulnerable webpages from XSSed as well as 8,063 webpages that can simulate
XSS worms (weibo.com). They have compiled a feature database, consisting of
features that encapsulates the attributes mentioned before. To extract these
features automatically, they have developed a feature extractor that takes the
collected web pages as its input and generates the corresponding feature
vectors as its output. Using this feature database, they have trained two
classifiers: an alternative decision tree (ADTree) and an adaptive boosting
(Adaboost). They have evaluated the performance of their approach, and it was
reported that the higher precision and recall were obtained with AdaBoost
algorithm, the scores were precision=0.941, recall=0.939 and F1 score=0.939.
Although the scores for ADTree were also comparable with precision=0.938,
recall=0.936 and F1 score=0.936.
Pros \- Suggested features have shown to be effective. The caliber of the
extracted features has a direct impact on the classification effect.
Cons \- XSS vulnerable webpages and XSS worms vulnerable pages were from a
single source.

Predicting Cross-Site Scripting (XSS) security vulnerabilities in web
applications [2015]
K Gupta et al. [15] proposed a method to use predictive models based on text
mining to find XSS susceptible code files in web applications. Their proposed
technique is based on using a customized way of tokenizing text features
(combining basic and context features). This method converts each code into a
specific collection of text features with a corresponding frequency. They have
settled with 20 features list (combining basic and context features). Using
the WEKA tool, they have conducted all the experiments and have repeated all
the experiments 10 times with randomly chosen train and test splits. According
to their reported evaluation results, bagging classifier outperformed the
other classifiers (SVM, Naive Bayes, Random Forest, etc.) and was able to
achieve the performance accuracy of 92.6% with the F score of 90.6%
Pros \- The argument made in the study is that current XSS vulnerability
prediction techniques do not take into account the user input context in the
output statement, which is essential for discovering context-sensitive
vulnerabilities. The performance of the model was greatly enhanced by taking
into account the user’s input’s context. Moreover, the study assesses the
effectiveness of several machine learning classifiers using a dataset of 1000
PHP files gathered from a number of open source projects.
Cons \- Effectiveness of this methodology is constrained with detecting
malicious code from the PHP application’s source files.

Detection of XSS in web applications using machine learning classifiers [2020]
Banerjee, et al.[21] utilized machine learning algorithms to extract
attributes that might be helpful to find vulnerabilities that XSS poses to web
applications. They have focused on generating the features which are based on
JavaScript and URL based attributes. They have constructed a dataset of total
1,611 JavaScript samples with 24 attributes out of which 1,453 samples were
benign whereas only 158 were malicious. They have assessed the accuracy and
the performance of the extracted features by using four different classifiers:
Random Forest, KNN, Logistic Regression and SVM. To validate the performance
of their approach they have further evaluated the trained models on test set.
Random Forest acquired the highest accuracy of around 98% for the XSS attack
classification.
Pros \- Projected approach was very straightforward yet effective. This
approach utilizes both JavaScript and URL features to detect various XSS
variants and evaluates the approach using a diverse dataset.
Cons \- Machine learning for XSS detection has certain significant challenges
that are not addressed, including scalability, robustness, flexibility, and
generalization which needs to be further investigated. It would have been
better if the feature engineering process targeted towards more complex and
generalizable features.

###  2.3 Limitations of Machine Learning approaches

Mentioned below are some major limitations of using machine learning
approaches for XSS classification:

  * •

The accuracy performance of a machine learning classifier is highly reliant on
the manually designed features that are provided to it.

  * •

Unfortunately, the generalization capability of machine learning algorithms is
also limited to the previous patterns and relationships in data.

  * •

Since XSS attacks may take many different forms and is more likely to change
frequently. Feature extraction can be very difficult in order to capture
unseen patterns. Therefore, fast evolution of XSS patterns may outpace the
performance of conventional machine learning techniques.

  * •

Not suitable for complex and large datasets.

  * •

Machine learning algorithms cannot compete against the performance of deep
learning methodologies.

###  2.4 Deep learning for XSS attacks classification

Due to the fact that shallow models strongly rely on the previous patterns and
reasoning, malicious behaviors that deviates distinctively in feature space
from those seen before fail to be classified, leading to low accuracy scores
and less scalability. In contrast, deep neural networks are more robust and
achieve better generalization. Without the need for extensive feature
engineering, deep models are capable of autonomously learning high-level
invariant representations from the training dataset and are able to accurately
classify even the samples that were not exposed while training and deviate
reasonably. Thus, it is fairly evident in [22] that deep learning approaches
are exceptionally better than classical machine learning approaches in terms
of detection accuracy, false alarm rate, and scalability. Discussed below are
some research publications that have applied robust and trending deep learning
architectures to detect and mitigate XSS attacks:

A Deep Learning Approach for Detecting Malicious JavaScript Code [2016]
Wang et al. [23] have applied deep learning techniques to classify malicious
JavaScript code accurately. They have proposed a deep learning framework
utilizing the stacked denoising autoencoder model that automatically learns
the deep features for pattern recognition. They have formed a dataset of
27,103 samples in total out of which 12,320 belong to the benign class and
14783 belongs to the malicious class. Samples in the dataset were either
obfuscated or plain JavaScript. In the preprocessing stage, every input was
translated into binary feature vectors by converting every character in the
code sample into 8bit binary codes and all the segments were saved as a binary
file. By taking the advantage of sparse random projections, authors have
reduced the dimensions of the dataset up to 480 dimensions in order to lower
the computational cost and time. After they have trained the SdA network, they
evaluated the performance of their proposed approach SdA-LR and from the
reported results, it can be concluded that it was able to outperform the
previous machine learning algorithms with lower inference time and better
detection accuracy.
Pros \- SdA was able to optimize the performance accuracy of Logistic
Regression and SVM. Inference time was comparatively very low. No extensive
feature engineering was required. It can deal with JavaScript code that is
obscured, which is a typical tactic employed by adversaries to avoid
detection.
Cons \- False positive rate of the proposed approach was around 4.2%, which is
relatively very high. Training time was considerably very long. Required more
computing resources. Requires an extensive amount of labeled data for
training.

DeepXSS: Cross Site Scripting Detection Based on Deep Learning [2018]
Fang Y et al. [24] presented a deep learning-based strategy for XSS attacks
detection called “DeepXSS”. They have first preprocessed the input by passing
it via a decoder that iteratively employs every possible decoding schemes. The
next step in the preprocessing process was generalization of the decoded data
where URLs were substituted with “http://website”, numbers with “0”, strings
with “param_string” and special characters were eliminated. Last step of
preprocessing was tokenization of the input. After that, they have used
word2vec to extract the features which encapsulates the semantic knowledge of
the XSS payloads. Then, they have trained a RNN based architecture, LSTM (long
short term memory) network using those feature embeddings. 33,426 Malicious
samples were gathered from XSSed database whereas 31,407 benign samples were
gathered from the DMOZ database for conducting the experiments. From the
experimental results, as reported by the authors, we can assess that the LSTM
based detection method can be very effective, since it was able to reach a
precision of 0.995 and a recall of 0.979.
Pros \- This research was a valuable nudge towards this specific direction of
applying LSTMs (or deep learning methodologies) for XSS detection. Dataset
used for experiments was also nearly balanced.
Cons \- Focus on complete coverage of all the security-sensitive aspects of
XSS was not the part of this research. Moreover, using embeddings can make the
training process exceedingly time-consuming, and cumbersome.

MLPXSS: An Integrated XSS-Based Attack Detection Scheme in Web Applications
Using Multilayer Perceptron Technique [2019]
F. M. M. Mokbal et al. [25] have presented a rudimentary but a novel ANN based
model for identifying XSS attacks and have integrated that with an adaptable
feature extraction procedure that extracts digital dataset as features, based
on URL, HTML, and JavaScript based attributes of the datasets. For their
research, authors have constructed a huge uniformly randomized dataset,
comprised of 138,569 distinctive records with benign samples (100,000) and
malicious samples (38,569) of 41-dimensions. Later, a feed forward network
(multi layer perceptron model) is trained for the classification of XSS
attacks. This approach was assessed on the unseen testset of 27,714 samples
(with 19,967 benign and 7,747 malicious samples) to prove the viability of the
suggested model and acquired an overall accuracy of 99.32% with
precision=0.99, and recall=0.98. After comparatively evaluating the proposed
method with the existing methods (since the malicious samples were gathered
from XXSed), it was concluded that the proposed approach relatively better.
Pros \- Feature extractor technique was able to obtain suitable and more
relevant feature vectors that was able to differentiate the XSS anomaly more
precisely. By utilizing a low complexity deep neural network model in
conjunction with a flexible and adaptable feature extractor, makes it platform
independent. Both the client-side and the server-side of a system can use it
as a security layer
Cons \- Limitations of this research includes the real-time detection of XSS
attacks. Detection rate of 98.35% can also be improved.

XSS Detection Technology Based on LSTM-Attention [2020]
Lei L et al. [26] proposed another LSTM based model that additionally utilizes
the attention mechanism for distinguishing XSS. At first, by taking the
advantage of decoding procedure at the preprocessing phase, they have
eliminated the encodings from the datasets. Next, from the datasets, they have
omitted the HTML and URL encodings, to decrease the dimensions of data. They
have further standardized the dataset by performing some replacements like,
substituting a number with “0” and URLs with “http://u”. In order to extract
the features from the datasets, they have developed a number of unique regular
expressions, and then utilized word2vec (for vectorization) to create feature
vectors for training the network. Utilizing an LSTM network, abstract features
of an XSS attack were obtained and attention mechanism was applied to enhance
the classification performance. Proposed LSTM-Attention model was later
evaluated and after conducting, a number of experiments, it was apparent that
the model’s classification performance is improved by adding the attention
method as it was able to acquire significantly better precision of 99.3% and
recall of 98.2% in successfully classifying XSS.
Pros \- Precision score, recall score, and F1 score all escalated, when
attention mechanism was incorporated into the LSTM network, by 2.9%, 1.9%, and
2.1%, respectively.
Cons \- Generalization accuracy of the model can be further enhanced, if other
types of XSS data is gathered in order to capture more complex and varying
form of XSS.

Cross Site Scripting Attacks Classification using Convolutional Neural Network
[2022]
Kumar J et al.[27] have developed a CNN based architecture for XSS
classification. They have constructed a dataset from XSSed that consisted of
17,750 samples which includes both malicious and benign scripts. The
obfuscation from the scripts was first eliminated. They have translated all
the characters of the XSS code scripts into their ASCII representations
(reshaped and resized into [120,120]), eliminating non-ASCII characters. To
standardize the feature matrix, it was further divided by 128. They
transformed the vector into a [120,120] two-dimensional matrix, which they
have used as an input for CNN network. Their proposed CNN technique was able
to acquire the accuracy of about 98%.
Pros \- General characteristics of a CNN architecture does not require
extensive pre-processing feature extraction as compared to other
classification ML algorithms. The strategy which authors have used for feature
development, takes into account every character in the dataset, as well as
their order and sequence. As a result, the proposed method is more adapted for
continuously evolving XSS.

Detect Cross-Site Scripting Attacks Using Average Word Embedding and Support
Vector Machine [2022]
F. M. M. Mokbal et al.[28] have proposed NLP-SVM approach for detecting web-
based XSS threats. NLP was used to pre-process the XSS attack payloads and the
classification task was performed by employing a SVM model. These payloads
were transformed into vectors at the payload level. For each attack payload, a
vector was obtained at payload-level for each sample by averaging the word-
level. From the complete dataset, a total of 20,257 vectors of 96 dimensions
each were extracted. Using a robust, supervised machine learning technique,
such as SVM, the generated vectors were then utilized to model. A thorough
analysis of the reported results revealed that the suggested approach could
easily and effectively identify XSS-based attacks with exceptionally higher
accuracy along with lower false negative (0.4%) and false positive (1.0%)
rates.
Pros \- The proposed approach successfully outperformed the well-known 8
algorithms that made use of the identical data by a wide margin. With a low
percentage of FP (false positives) and FN (false negatives), the proposed
method achieved higher accuracy and an incredible detection rate.
Cons \- Attack payloads could be automatically extracted from the content
using some sort of automated method.

###  2.5 Deep Learning for XSS vulnerabilities classification

Researchers have also applied deep learning strategies to detect XSS
vulnerabilities. Followings are some of the works under this category:

Link: Black-Box Detection of Cross-Site Scripting Vulnerabilities Using
Reinforcement Learning [2022]
Lee S et al.[29] have aimed at automatically detecting the reflected XSS
vulnerabilities by utilizing the reinforcement learning in a black box
setting.
Background \- Although, there are several penetration tools to detect this
form of XSS attack which are easy to use and deploy, unfortunately there are
some drawbacks to that. Penetration tools uses a predefined attack payload
dictionary and it does not consider the context of the target payload that is
context-unaware payload. If the dictionary does not contain a working payload
then the detection will fail, leading to false negatives. Moreover, if the
dictionary is considerably large and the exploitable payload exist in the end
of the dictionary, there will be a lot of unnecessary requests and it will
increase request overhead of the penetration testing.
Proposed Solution \- In this research, authors have presented “Link” which
leverages reinforcement learning to generate context-aware payloads. Link
generates XSS attack payloads using generation and mutation rules; after
executing each payload, Link takes feedback from a target application to
automatically generate context-aware payloads.
Reinforcement Learning \- The agent and environment, both are required for
reinforcement learning. The agent’s role is to decide on an action based on
the state from the given environment and then the chosen action will modify
both the environment and the environment’s state. Next, the environment
computes reward to determine if the selected action is effective. After giving
the agent the incentive and the state information, the agent decides the next
action based on the reward and state. That is how the agent learns the best
course of actions to maximize the overall reward, by repeating these steps.
This iterative procedure is what authors have used to identify cross-site
scripting vulnerabilities, where the action corresponds to a generation or
mutation rule for producing a payload, the environment corresponds to a target
application and the reward and state corresponds to a feedback from the target
application.
Objectives \- reducing the number of requests and increasing true positives
were two primary goals of this research. Implementation – The first design
component is “action”. Link supports 2 action types: generation and mutation.
We have seven generation rule that generates the basic payload for further
mutation and we have 32 mutation rules that mutate the basic payloads from the
generation. The next design component is “state”, which provides the
information of the environment to the agent. It contains 47 features and these
feature vectors consist of scaler values that represents the respective
feature’s existence or its type. These features can be divided into three
types: information about the input payload, the injection point and about the
attack result. The first type of the state is the payload information and
these features tell information about the appearance of the payload. The
second type of the state is the injection point information. The injection
point represents whether the attack payload is placed in the response. The
last type of state is information about the attack result. From the attack
response, Link analyzes how the injected payload is reflected. The last design
component is “reward”. So, it gives a positive reward when the attack succeeds
and gives bigger reward as the number of attempted requests is lesser. Also,
Link gives the negative reward, if the agent chooses the same actions or tries
the same payload because it is it is inefficient to try a failed attempt
again.
Evaluation – After conducting extensive experiments, Link was evaluated
against 4 state-of-the-art penetration testing tools and the reported results
proved that Link outperformed them by detecting the highest number of bugs
with lower number of requests.
Pros – In contrast to earlier methods, Link does not require manual
intervention to assess selected behaviors in given environments. Link can
detect vulnerabilities in the shortest possible time. The benchmark was not
included in the training set yet Link still managed to acquire highest score
in vulnerability detection. The prospective effectiveness of utilizing
reinforcement learning to discover reflected XSS vulnerabilities is further
shown by Link, that also uncovered 43 vulnerabilities in 12 real-world apps,
which none of the scanners used in the evaluation were able to discover
Cons \- The amount of time needed for training and testing increased by 20%
when utilizing a headless browser.

##  3 Cross Site Request Forgery

Cross-site request forgery, commonly known as CSRF [30], is one of the most
simplest yet effective web attack. CSRF is a web-vulnerability in which any
malicious website instructs or coerces a victim’s web browser to send a
request to a target website that is vulnerable to perform any security
sensitive operation and these malicious requests appear to be a victim’s
interactions with the target website, taking advantage of the victim’s network
access and browser settings like cookies.

###  3.1 Static and rule-based CSRF defenses

Followings are some popular mitigations that exist to prevent CSRF attack[31]:

  * •

Use CAPTCHAs, one-time passwords, or enforce re-authentication to block cross-
site requests from passing through undetected.

  * •

Authenticating a private/secret request token.

  * •

Verifying the HTTP request headers.

  * •

Verifying custom headers attached to XMLHTTPRequests

But unfortunately, each of these mechanisms has their own pitfalls and are not
entirely satisfactory since they may not work in some cases. In order to
maintain a balance between security and usability, need for automated CSRF
approaches was comprehended.

Automatic Black-Box Detection of Resistance Against CSRF Vulnerabilities in
Web Applications
Another black-box, language agnostic CSRF detection method was proposed method
by Sadeghi et al.[32] that passively identifies CSRF-resistant requests by
accessing and examining the browser-server traffic to the target website which
does not causes unauthorized database changes to compare the application
behavior to a deliberately fabricated request. In this research, authors have
defined some set of rules to investigate the presence of anti-CSRF tokens in
traffic and determines whether a request is potentially vulnerable or not.

Same Site Cookies comes to the rescue
Same Site cookies[33] is another recently proposed and a very effective
mechanism, that is intended to provide defense against the whole family of
cross site attacks. Same site cookies are technically generic cookies but with
a supplementary attribute of ‘same site’ which is controlled and regulated by
the website that sets the cookie with the labels ‘lax’ or ‘strict’. If the
value of the same site attribute is set to ’strict’ then the cookie is most
likely to be excluded from any cross site requests. But in the case of
attribute value ‘lax’, the cookie might be included in top-level cross-site
GET requests. Same site cookies are supported by popular browsers like Opera,
Firefox[34], Chrome[35], and Edge[36] and browsers that doesn’t support same
site cookies, simply handle them as regular cookies.

Multiple blogs and comprehensive studies [37], [38] have been published that
have thoroughly evaluated the efficacy of same site cookies.

Applicability, adaption, effectiveness, and in-depth evaluation of the same
site cookie was thoroughly explored and investigated at a large-scale in the
study by S. Khodayari and G. Pellegrino[38], where they have extensively
conducted experimentations to assess it’s practical usage as well as it’s
impact; that is if it is set to default, it can cause disruption in
functionalities. Authors have also looked over to the threats against the
efficiency of same site cookies and the security coverage provided by the Lax
policy.

Authors have systematically revealed different weak areas and issues of the
same site cookie policy which is a beneficial step to improve by fixing it’s
problems but correspondingly they have also stated the limitations and the
need to transcend above static, pre-packaged policies by discovering more
adaptable and customizable same site policies. Such methods require careful
and accurate use of security measures, to capture full protection without
negatively affecting the user experience.

###  3.2 Towards automated CSRF detection

When it comes to XSS vulnerability detection, there has been a lot of efforts
that has been invested to put forward many approaches but most of the prior
works presented to detect CSRF vulnerability detection is heavily inclined
towards manual tactics and are mainly white-box.

Therefore, an automated approach for preventing CSRF was first introduced
through Deemon[39] which is a model-based framework for security testing
intended to detect CSRF vulnerabilities with dynamic analysis, using program
status changes, data flow patterns, and graph properties and is built on the
PHP interpreter’s runtime monitor.

###  3.3 Employing ML procedures for automated and black box CSRF detection

Even though Deemon has proven to be effective there are certain shortcomings
of this approach. Firstly, it is not a language-agnostic analyzer since it
only operates on PHP applications and secondly, it requires the accessibility
of the source code for dynamic analysis.

Mitch: A Machine Learning Approach to the Black-Box Detection of CSRF
Vulnerabilities [2019]
Calzavara et al.[40] offered an automated black-box solution Mitch to overcome
these limitations by utilizing ML approach, for the first time, to classify
HTTP request as ”sensitive” or ”non-sensitive” automatically. Authors have
approached this task in a supervised manner and for that they had to come up
with a dataset of 5828 HTTP requests (out of which 939 were sensitive
requests), which they constructed by accumulating requests from 60 popular
websites (according to Alexa ranking) and they have published it for future
researches.

Subsequently, they have done feature engineering, as they were not only
interested in classifying sensitive HTTP requests precisely accurately but
also interested to know which features were interpretable and led to certain
predictions. This is also the primary

They have further used their constructed dataset to train and test multiple
binary classifiers Logistic Regression, Decision Trees, Random Forests, SVM,
and Gradient Boosted Decision Trees and have selected the classifier which
contributed the best ROC AUC scores which was Random Forest with a score of
0.932 on training set and 0.924 on test set (along with a F1 score of 0.72).
They have also assessed the performance of the best classifier with the
existing methods CsFire[41] and BEAP[42].

Using the best-performing classifier as a building block, authors have
developed a browser extension called Mitch; which is a language-agnostic tool
to identify CSRF, which functions without getting the access to the web
application’s source code.

Lastly, they have done some experiments where they have concluded the accuracy
of Mitch which achieved a score of 0.78 F1 score on 20 top Alexa websites and
they have also compared it’s performance with Deemon on 3 PHP applications
where it exceled. They have concluded that there aren’t many FP (false
positives) or FN (false negatives) returned by Mitch.

Incompetent aspects of the suggested technique In this research, authors have
focused on certain type requests that they have considered to be “sensitive”
and those are “visibly sensitive requests” that changes any security-relevant
web application state which is visible at the browser side when processing the
corresponding response. Keeping this definition in mind, HTTP requests were
collected and labelled as sensitive. Since using this strategy binary
classifiers were trained, it is certainly irrelevant to compare the
performance of CsFire[41] and BEAP[42] because they carries a different
definition of what they consider to be sensitive. Also, Mitch will not be able
to cater all the server side changes that has no direct impact on the browser
side.

Although broader coverage is undoubtedly a crucial feature of real-world
security. However, authors have not focused on complete coverage of all the
security-sensitive features and have only conducted a much brief navigation
session in all the trials because the prototype does not have any crawler
component.

Researchers have simulated CSRF attacks using Mitch on sensitive requests,
which may lead to inappropriate changes to the application database due to its
invasive nature.

Because there was a severe class imbalance in the dataset, they have gone for
stratified random sampling to make sure there is even distribution of
sensitive and non-sensitive request in training and testing. Conversely, it
would have been interesting, if rather than training binary classifiers,
authors have resolved this task using one class classification.

##  4 Burp Suite meets Machine Learning

Burp Suite is a Java-based framework that offers an extensive set of tools for
web and mobile app penetration testing. It accomplishes this by depicting and
controlling all traffic between the attacker and a web server. Burp suite is
considered as a state-of-the-art scanner for web vulnerabilities. In this
proposed work[43], researchers have applied advanced ML algorithms to the Burp
Suite extension for detecting vulnerabilities like Cross-Site Request
Forgery(CSRF), SQL injection, and XML External Entity.

##  5 Related Works

Many surveys have been released that reviewed different methods to detect and
prevent XSS or CSRF web attacks. However, only a few number of publications,
have been published under the general heading of using various machine
learning approaches to identify and counteract CSRF and XSS attacks.

Since Calzavara et al. [40] were the first authors to apply machine learning
to tackle a CSRF attack, there has been no study so far that has focused on
covering automated or utilizing machine learning to cater CSRF attacks.

For the purpose of classifying XSS, Chen, X. et al.[3] described many
approaches that have applied different machine learning techniques XSS web
detection. Their reporting was very brief and they didn’t include any
noteworthy deep learning-based approaches.

An extensive survey of XSS detection methods was issued by M. Liu e al.[4],
but unfortunately their focus was not completely on targeting machine learning
approaches to cater XSS attacks. However, they covered a few machine learning
based methods.

In 2021, Kaur J. et al[5] published a survey that exclusively aimed at the
works of applying machine learning for XSS detection and mitigation.
Unfortunately, they have focused on 10-11 recent works, between 2018 to 2021
and only reported two deep learning based approaches. Many of the significant
works were not included in their coverage.

According to my knowledge, this is the first survey to date, that has included
most of the research works that have been published in both the machine
learning and deep learning settings.

##  6 Conclusion

In this paper, several research studies are discussed that have tackled web
attacks like XSS and CSRF, using conventional machine learning and advanced
deep learning methodologies. After going through different approaches, it can
be concluded that, although the focus of all research works was to prevent the
attacks, but every research is limited to certain constraints. Therefore,
there is no single, generic method that can be applied to protect the web
application from all the variants of a certain attack, entirely. However, to
come up with a better and near-to-perfect mechanism it is important to have a
better understanding of the attack, it’s characteristics under different
aspects, and it’s impact on the web application. Researchers shouldn’t try to
accommodate simple attacks that has less impact and rather should try to go
for more complex and difficult attacks that has major impact, in such a way,
that can reduce the rate of false alarms as much as possible, increase the
accuracy so that no attack is missed, generic enough to be deployed for
different variants without much tuning, scalable enough to cater attacks that
are evolving with time.

This survey can help researchers to understand how differently XSS or CSRF
have been resolved using the power of machine learning. So far, we can
establish from the remarkable results in the conducted experiments that it is
a compelling direction to achieve accuracy, scalability, and generalization.
This can also be observed that how challenging this simple task can be and
there has been methods, mentioned in this study, that has provided a way to
tackle the attacks, but have some shortcomings which can be further
investigated. And if there has been a study that has only focused on a certain
variant of attack but one feels promising enough and can further take it to
see how it works for other variants, can also be very beneficial.

Reviewing several research papers and publications on XSS detection led to the
deduction that a substantial portion of research has been done on XSS
classification using machine learning and deep learning, whilst reinforcement
learning has not been given much attention up until the submission of Link by
Lei L. et al.[29], that has changed the whole perspective of how else
researchers can resolve the problem of XSS web vulnerabilities.

Regarding CSRF threats, Deemon[39] and Mitch[40] were two notable initiatives
that considerably reduced the challenge of classifying CSRF vulnerabilities
automatically. Nevertheless, if the concerns raised by [38] are remedied, same
site cookies could be a viable solution.

## References

  * [1] https://owasp.org/www-project-top-ten/
  * [2] Yanpeng Cui, Junjie Cui, and Jianwei Hu. 2020. A Survey on XSS Attack Detection and Prevention in Web Applications. In Proceedings of the 2020 12th International Conference on Machine Learning and Computing (ICMLC 2020). Association for Computing Machinery, New York, NY, USA, 443–449. https://doi.org/10.1145/3383972.3384027
  * [3] Chen, X., Li, M., Jiang, Y., Sun, Y. (2019). A Comparison of Machine Learning Algorithms for Detecting XSS Attacks. In: Sun, X., Pan, Z., Bertino, E. (eds) Artificial Intelligence and Security. ICAIS 2019. Lecture Notes in Computer Science(), vol 11635. Springer, Cham. https://doi.org/10.1007/978-3-030-24268-8_20
  * [4] M. Liu, B. Zhang, W. Chen and X. Zhang, ”A Survey of Exploitation and Detection Methods of XSS Vulnerabilities,” in IEEE Access, vol. 7, pp. 182004-182016, 2019, doi: 10.1109/ACCESS.2019.2960449.
  * [5] J. Kaur and U. Garg, ”A Detailed Survey on Recent XSS Web-Attacks Machine Learning Detection Techniques,” 2021 2nd Global Conference for Advancement in Technology (GCAT), Bangalore, India, 2021, pp. 1-6, doi: 10.1109/GCAT52182.2021.9587569.
  * [6] https://www.forbes.com/sites/forbestechcouncil/2022/03/14/cyber-vulnerability-statistics—2021-in-review/
  * [7] https://www.ptsecurity.com/ww-en/analytics/web-vulnerabilities-2020-2021/
  * [8] https://expertinsights.com/insights/50-web-security-stats-you-should-know/
  * [9] S. Kirsten, “Cross Site Scripting (XSS),” OWASP Foundation, 2020.
  * [10] B. Glas, “OWASP Top 10 Security Risks & Vulnerabilities,” OWASP Foundation, 2020.
  * [11] P. Likarish, E. Jung and I. Jo, ”Obfuscated malicious JavaScript detection using classification techniques,” 2009 4th International Conference on Malicious and Unwanted Software (MALWARE), Montreal, QC, Canada, 2009, pp. 47-54, doi: 10.1109/MALWARE.2009.5403020.
  * [12] R. Komiya, I. Paik and M. Hisada, ”Classification of malicious web code by machine learning,” 2011 3rd International Conference on Awareness Science and Technology (iCAST), Dalian, China, 2011, pp. 406-411, doi: 10.1109/ICAwST.2011.6163109.
  * [13] A. E. Nunan, E. Souto, E. M. dos Santos and E. Feitosa, ”Automatic classification of cross-site scripting in web pages using document-based and URL-based features,” 2012 IEEE Symposium on Computers and Communications (ISCC), Cappadocia, Turkey, 2012, pp. 000702-000707, doi: 10.1109/ISCC.2012.6249380.
  * [14] R. Wang, X. Jia, Q. Li and S. Zhang, ”Machine Learning Based Cross-Site Scripting Detection in Online Social Network,” 2014 IEEE Intl Conf on High Performance Computing and Communications, 2014 IEEE 6th Intl Symp on Cyberspace Safety and Security, 2014 IEEE 11th Intl Conf on Embedded Software and Syst (HPCC,CSS,ICESS), Paris, 2014, pp. 823-826.
  * [15] M. K. Gupta, M. C. Govil and G. Singh, ”Predicting Cross-Site Scripting (XSS) security vulnerabilities in web applications,” 2015 12th International Joint Conference on Computer Science and Software Engineering (JCSSE), 2015, pp. 162-167, doi: 10.1109/JCSSE.2015.7219789.
  * [16] S, Sharma P K, Park J H. XSSClassifier: An Efficient XSS Attack Detection Approach Based on Machine Learning Classifier on SNSs[J]. Journal of Information Processing Systems, 2017, 13(4).
  * [17] Khan, Nayeem & Khan, Shahid. (2017). Defending Malicious Script Attacks Using Machine Learning Classifiers. Wireless Communications and Mobile Computing. 2017. 1-9. 10.1155/2017/5360472.
  * [18] Mereani, Fawaz & Howe, Jacob. (2018). Detecting Cross-Site Scripting Attacks Using Machine Learning. 10.1007/978-3-319-74690-6_20.
  * [19] Mereani, Fawaz & Howe, Jacob. (2018). Preventing Cross-Site Scripting Attacks by Combining Classifiers. 135-143. 10.5220/0006894901350143.
  * [20] S. Kascheev and T. Olenchikova, ”The Detecting Cross-Site Scripting (XSS) Using Machine Learning Methods,” 2020 Global Smart Industry Conference (GloSIC), Chelyabinsk, Russia, 2020, pp. 265-270, doi: 10.1109/GloSIC50886.2020.9267866.
  * [21] Banerjee R, Baksi A, Singh N, Bishnu SK. Detection of XSS in web applications using machine learning classifiers. IEEE IEMENTech; 2020:1-5.
  * [22] A. Abeshu and N. Chilamkurti, “Deep learning: The frontier for distributed attack detection in fog-to-things computing,” IEEE Commun. Mag., vol. 56, no. 2, pp. 169–175, Feb. 2018.
  * [23] Y. Wang, W.-D. Cai, and P.-C. Wei, “A deep learning approach for detecting malicious JavaScript code,” Secur. Commun. Netw., vol. 9, no. 11, pp. 1520–1534, Jul. 2016.
  * [24] Fang Y, Li Y, Liu L, et al. DeepXSS: Cross Site Scripting Detection Based on Deep Learning[C]//Proceedings of the 2018 International Conference on Computing and Artificial Intelligence, Chengdu, Mar 12-14, 2018. New York : ACM, 2018: 47-51.
  * [25] Mokbal FMM, Dan W, Imran A, Jiuchuan L, Akhtar F, Xiaoxi W. MLPXSS: an integrated XSS-based attack detection scheme in web applications using multilayer perceptron technique. IEEE Access. 2019;7:100567-100580.
  * [26] Lei L, Chen M, He C, Li D. XSS detection technology based on LSTM-attention. IEEE 5th International Conference on Control, Robotics and Cybernetics; 2020:175-180.
  * [27] Kumar J, Santhanavijayan A, Rajendran B. Cross site scripting attacks classification using convolutional neural network. IEEE ICCCI;2022:1-6.
  * [28] Mokbal FMM, Wang D, Wang X. Detect cross-site scripting attacks using average word embedding and support vector machine. Int J Netw Secur. 2022;4(1):20-28.
  * [29] Lee S, Wi S, Son S. Link: black-box detection of cross-site scripting vulnerabilities using reinforcement learning. ACM Web Conference; 2022:743-754.
  * [30] https://owasp.org/www-community/attacks/csrf
  * [31] Adam Barth, Collin Jackson, and John C. Mitchell. 2008. Robust defenses for cross-site request forgery. In Proceedings of the 15th ACM conference on Computer and communications security (CCS ’08). Association for Computing Machinery, New York, NY, USA, 75–88.
  * [32] M. A. Hadavi and S. Sadeghi, “Automatic Black-Box Detection of Resistance Against CSRF Vulnerabilities in Web Applications,” JCS, vol. 8, no. 1, Jan. 2021, doi: 10.22108/jcs.2021.127261.1064.
  * [33] West, M., and Goodwin, M. Same-site cookies. Internet Draft draft-ietf-httpbis-cookie-same-site-00, IETF Secretariat, June 2016.
  * [34] BLOG, M. S. Supporting same-site cookies in firefox 60. https://blog.mozilla.org/security/2018/04/24/same-site-cookies-in-firefox-60/, 2018.
  * [35] West, M. ’samesite’ cookie attribute. https://www.chromestatus.com/feature/4672634709082112, 2017.
  * [36] Microsoft. Platform status. https://developer.microsoft.com/en-us/microsoft-edge/platform/ status/samesitecookies/, 2018.
  * [37] L. Compagna, H. Jonker, J. Krochewski, B. Krumnow and M. Sahin, ”A preliminary study on the adoption and effectiveness of SameSite cookies as a CSRF defence,” 2021 IEEE European Symposium on Security and Privacy Workshops (EuroS&PW), Vienna, Austria, 2021, pp. 49-59, doi: 10.1109/EuroSPW54576.2021.00012.
  * [38] S. Khodayari and G. Pellegrino, ”The State of the SameSite: Studying the Usage, Effectiveness, and Adequacy of SameSite Cookies,” 2022 IEEE Symposium on Security and Privacy (SP), San Francisco, CA, USA, 2022, pp. 1590-1607, doi: 10.1109/SP46214.2022.9833637.
  * [39] Pellegrino, Giancarlo et al. “Deemon: Detecting CSRF with Dynamic Analysis and Property Graphs.” Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security (2017): n. pag.
  * [40] S. Calzavara, M. Conti, R. Focardi, A. Rabitti, and G. Tolomei, “Mitch: A Machine Learning Approach to the Black-Box Detection of CSRF Vulnerabilities,” in 2019 IEEE European Symposium on Security and Privacy (EuroS&P), Stockholm, Sweden, Jun. 2019, pp. 528–543. doi: 10.1109/EuroSP.2019.00045.
  * [41] P. D. Ryck, L. Desmet, T. Heyman, F. Piessens, and W. Joosen, “Csfire: Transparent client-side mitigation of malicious cross-domain requests,” in Engineering Secure Software and Systems, Second International Symposium, ESSoS 2010, Pisa, Italy, February 3-4, 2010. Proceedings, 2010, pp. 18–34
  * [42] Ziqing Mao, Ninghui Li, and Ian Molloy. 2009. Defeating Cross-Site Request Forgery Attacks with Browser-Enforced Authenticity Protection. Financial Cryptography and Data Security: 13th International Conference, FC 2009, Accra Beach, Barbados, February 23-26, 2009. Revised Selected Papers. Springer-Verlag, Berlin, Heidelberg, 238–255. https://doi.org/10.1007/978-3-642-03549-4_15
  * [43] T.Rrezearta, V. Kamer, R. Blerim ”Enhancing Burp Suite with Machine Learning Extension for Vulnerability Assessment of Web Applications”