Enhancing Security of Web-Based IoT Services via XSS Vulnerability Detection.

Area of Science:

• Computer Science
• Cybersecurity
• Software Engineering

Background:

• The Internet of Things (IoT) is rapidly expanding, increasing the attack surface for cyber threats.
• Cross-Site Scripting (XSS) remains a significant vulnerability in web applications, including those within the IoT ecosystem.
• Existing methods often struggle with high false positive rates or lengthy analysis times for XSS detection.

Purpose of the Study:

• To propose and validate a novel XSS detection scheme for IoT web application services.
• To enhance the accuracy and efficiency of vulnerability detection.
• To minimize false positives and reduce analysis time.

Main Methods:

• Developed a framework integrating symbolic execution and dynamic taint analysis.
• Defined an instrumentation scheme for taint analysis and concolic executions.
• Automated the vulnerability detection process for web applications.

Main Results:

• Achieved a 90.62% detection rate for XSS threats on the SecuriBench Micro dataset.
• Attained a 69.11% detection rate on the OWASP dataset.
• Demonstrated 0% false positives, pinpointing exact vulnerability locations and risky inputs.

Conclusions:

• The proposed scheme effectively enhances IoT web application security against XSS attacks.
• The combined approach offers a robust solution for accurate and efficient vulnerability identification.
• The framework facilitates the precise removal of detected security flaws.