An Execution-flow Based Method for Detecting Cross-Site Scripting Attacks

摘要：

We present an execution-flow analysis for JavaScript programs running in a web browser to prevent Cross-site Scripting (XSS) attacks. We construct finite-state automata (FSA) to model the client-side behavior of Ajax applications under normal execution. Our system is deployed in proxy mode. The proxy analyzes the execution flow of client-side JavaScript before the requested web pages arrive at the browser to prevent potentially malicious scripts, which do not conform to the FSA. We evaluate our technique against several real-world applications and the result shows that it protects against a variety of XSS attacks and has an acceptable performance overhead.

关键词： XSS FSA JavaScript Ajax

作者: Qianjie Zhang Hao Chen Jianhua Sun Adv. Internet Media Lab

作者单位: School of Computer and Communication. Hunan University Changsha, China

会议类型: 国际会议

会议名称: The 2nd International Conference on Software Engineering and Data Mining(IEEE 第二届国际软件工程和数据挖掘学术大会 SEDM 2010)

会议地点: 成都

会议语种:英文

页码: 70-75

在线出版日期: 2010-06-23（万方平台首次上网日期，不代表论文的发表时间）