关键词: 跨站脚本攻击, 特征值, Web安全漏洞, SMO-RFE算法, 信息安全

Abstract:

When the attacker uses the Web APP to inject malicious code into different end users, XSS attacks will occur. In the light of the phenomenon that Web application uses the user's input, but don’t verify or encode it, this paper put forward a kind of recursive feature elimination algorithm matching algorithm and sequential minimal optimization based on regular expression (SMO-RFE). The first is the data preprocessing, using regular expression matching algorithm, choose the characteristics of representative data set for the training set; then use the SMO-RFE feature selection algorithm to select the optimal features; once again feature sort and assemble the aggressive keywords; finally summarize the occurrence frequency of feature keyword and the weight ratio of feature value. The higher the occurrence frequency of attack keywords, the greater the likelihood of vulnerabilities. Through the experiment we can find out that after the data set is selected by SMO-RFE algorithm, the accuracy of SVM feature vector to be detected is higher, and shows that the algorithm can effectively detect XSS vulnerabilities.

Key words: cross site script attack, feature value, Web security vulnerabilities, SMO-RFE algorithm, information security