![](bg8.png)
level classifier it was found that k-NN was consid-
erably more expensive than other classifiers. This
motivated the study of results without k-NN in the
stacking ensemble. Without k-NN, the SVM-P meta-
classifier performs a little less well, with accuracy re-
duced from 99.92% to 99.85%. In security higher
accuracy is better even if the time is longer, as long
as the application continues to work smoothly. It is
also worth observing that in this instance, the SVM-
L meta-classifier performance is best, illustrating that
with all the meta-classifiers performing well it is hard
to determine an overall best choice.
6 CONCLUSION
This paper has demonstrated a system that contains
two stages, each stage containing a classifier doing
a different job. The first stage classifies user input
either as normal text or as a script, with accuracy of
up to 99.97%. The second stage depends on a stacked
classifier based on SVM-L, SVM-P, k-NN, RF, and
NN. This stacked classifier with SVM-P as the meta
classifier gives high accuracy when applied to a large
real attack dataset. The entire system cascading the
two stages together achieved high precision (99.96%)
for defending web applications from XSS.
This final accuracy result improves on the re-
sults with the same dataset from (Mereani and Howe,
2018) (where precision was 96.79%). This is partly
because of an improved feature set, and partly be-
cause of the use of stacking. It is important to note
that cascading allows the classifier to be used in a real
web application where the script classifier is preceded
by the text classifier. A proof of concept website in-
corporating the cascading classifier as a security layer
has been constructed, and with a single user operates
successfully. The cost of the k-NN classifier in the
base level of the ensemble classifier is the dominating
cost of the overall classifier. This was not problematic
at the proof of concept stage. Future work is to test the
performance of websites involving such a cascading
classifier by performing large scale load testing.
Some scripts are still misclassified. Misclassifi-
cation occurs for malicious scripts encrypted using
Base64 encoding. Base64 uses letters more than num-
bers or signs. This result hints that adding to the en-
semble a classifier aimed at this type of encryption
would add to the power of a combined classifier.
In conclusion this work demonstrates that combin-
ing classifiers can lead to better overall classification
by incorporating diversity into the classification pro-
cess, and that a security layer can be incorporated into
web applications for detecting XSS attacks.
REFERENCES
Ariu, D. and Giacinto, G. (2011). A modular architecture
for the analysis of HTTP payloads based on multi-
ple classifiers. In Multiple Classifier Systems, volume
6713 of LNCS, pages 330–339. Springer.
Ariu, D., Tronci, R., and Giacinto, G. (2011). HMM-
Payl: An intrusion detection system based on Hidden
Markov Models. Computers & Security, 30(4):221–
241.
Baig, A., Bouridane, A., Kurugollu, F., and Albesher, B.
(2014). Cascaded multimodal biometric recognition
framework. IET Biometrics, 3(1):16–28.
Bloch, I. (1996). Information combination operators for
data fusion: a comparative review with classifica-
tion. IEEE Transactions on Systems, Man, and
Cybernetics-Part A: Systems and Humans, 26(1):52–
67.
Breiman, L. (1996). Bagging predictors. Machine Learn-
ing, 24(2):123–140.
Cao, D.-S., Xu, Q.-S., Liang, Y.-Z., Zhang, L.-X., and Li,
H.-D. (2010). The boosting: A new idea of build-
ing models. Chemometrics and Intelligent Laboratory
Systems, 100(1):1–11.
Chand, N., Mishra, P., Krishna, C. R., Pilli, E. S., and Govil,
M. C. (2016). A comparative analysis of SVM and its
stacking with other classification algorithm for intru-
sion detection. In Advances in Computing, Communi-
cation, & Automation, pages 1–6. IEEE.
Dasarathy, B. V. and Sheela, B. V. (1979). A composite
classifier system design: concepts and methodology.
Proceedings of the IEEE, 67(5):708–713.
Dietterich, T. G. (2002). Ensemble learning. The handbook
of brain theory and neural networks, 2:110–125.
Drucker, H., Cortes, C., Jackel, L. D., LeCun, Y., and Vap-
nik, V. (1994). Boosting and other ensemble methods.
Neural Computation, 6(6):1289–1301.
D
ˇ
zeroski, S. and
ˇ
Zenko, B. (2004). Is combining classi-
fiers with stacking better than selecting the best one?
Machine Learning, 54(3):255–273.
Gama, J. and Brazdil, P. (2000). Cascade generalization.
Machine Learning, 41(3):315–343.
Goel, J. N., Asghar, M. H., Kumar, V., and Pandey, S. K.
(2016). Ensemble based approach to increase vulner-
ability assessment and penetration testing accuracy. In
Innovation and Challenges in Cyber Security, pages
330–335. IEEE.
Jacobs, R. A., Jordan, M. I., Nowlan, S. J., and Hinton, G. E.
(1991). Adaptive mixtures of local experts. Neural
Computation, 3(1):79–87.
Jordan, M. I. and Jacobs, R. A. (1994). Hierarchical mix-
tures of experts and the EM algorithm. Neural Com-
putation, 6(2):181–214.
Khan, N., Abdullah, J., and Khan, A. S. (2017). Defending
malicious script attacks using machine learning clas-
sifiers. Wireless Communications and Mobile Com-
puting, 2017(5360472):9 pages.
Khor, K.-C., Ting, C.-Y., and Phon-Amnuaisuk, S. (2012).
A cascaded classifier approach for improving detec-
IJCCI 2018 - 10th International Joint Conference on Computational Intelligence
142