Generative Adversarial Network-based Approach for Automated Generation of Adversarial Attacks Against a Deep-Learning based XSS Attack Detection Model
Rokia Lamrani Alaoui, El Habib Nfaoui · International Journal of Advanced Computer Science and Applications · 2023
Cross Site Scripting attack (XSS) is one of the most famous and dangerous web attacks. In XSS attacks, illegitimate technical methods are used by attackers to disclose sensitive data from web site users, which result in an important finance and reputation loss to the web site’s owner. There exist numerous XSS attack countermeasures. Deep Learning has been shown to be effective when used to detect XSS attacks in HTTP web requests. Yet, Deep Learning models are inherently vulnerable to adversarial attacks, which aim to deceive the detection model into mis-classifying malicious HTTP web requests. Thus, it is important to evaluate the robustness of the detection model against adversarial attacks before its deployment to production in real web applications. In this work, we developed a Generative Adversarial Network (GAN) model for automated generation of adversarial XSS attacks against an LSTM-based XSS attack detection model. We showed that the detection model performance drops drastically when evaluated on the XSS instances, originally used in the model development, but modified by the GAN model. We also provided some guidelines to the development of detection models that can defend against adversarial attacks in the particular context of web attacks detection.