用大模型生成复杂混淆攻击代码，提升机器学习检测跨站脚本能力。
Leveraging LLM to Strengthen ML-Based Cross-Site Scripting Detection
- 用大语言模型自动产生高复杂度混淆的恶意代码样本。
- 在混淆数据上训练的模型准确率达99.5%。
- 生成样本复杂度比传统工具高28.1%，适合真实安全防护场景。
根据开放网络应用安全项目（OWASP），跨站脚本（XSS）是关键安全漏洞之一。尽管研究多年，XSS仍位列十大安全风险。现有方法中，机器学习（ML）是主流手段，其效果高度依赖训练数据规模与多样性。传统非混淆样本训练的随机森林模型准确率达99.8%，但面对混淆型XSS时准确率降至81.9%，凸显需引入混淆数据训练。现有工具难以生成高复杂度混淆代码。本文提出微调大语言模型（LLM）生成复杂混淆的XSS payload，通过将原始攻击样本转化为多样变异体，构建更具挑战性的训练数据。实验表明，该方法使模型在混淆数据集上达到99.5%准确率。且生成样本复杂度比其他工具高出28.1%，显著增强模型应对高级攻击的能力，更适用于实际应用安全防护。
原文摘要 · Abstract (English)
According to the Open Web Application Security Project (OWASP), Cross-Site Scripting (XSS) is a critical security vulnerability. Despite decades of research, XSS remains among the top 10 security vulnerabilities. Researchers have proposed various techniques to protect systems from XSS attacks, with machine learning (ML) being one of the most widely used methods. An ML model is trained on a dataset to identify potential XSS threats, making its effectiveness highly dependent on the size and diversity of the training data. A variation of XSS is obfuscated XSS, where attackers apply obfuscation techniques to alter the code's structure, making it challenging for security systems to detect its malicious intent. Our study's random forest model was trained on traditional (non-obfuscated) XSS data achieved 99.8% accuracy. However, when tested against obfuscated XSS samples, accuracy dropped to 81.9%, underscoring the importance of training ML models with obfuscated data to improve their effectiveness in detecting XSS attacks. A significant challenge is to generate highly complex obfuscated code despite the availability of several public tools. These tools can only produce obfuscation up to certain levels of complexity. In our proposed system, we fine-tune a Large Language Model (LLM) to generate complex obfuscated XSS payloads automatically. By transforming original XSS samples into diverse obfuscated variants, we create challenging training data for ML model evaluation. Our approach achieved a 99.5% accuracy rate with the obfuscated dataset. We also found that the obfuscated samples generated by the LLMs were 28.1% more complex than those created by other tools, significantly improving the model's ability to handle advanced XSS attacks and making it more effective for real-world application security.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。