# Providing Email Privacy by Preventing Webmail from Loading Malicious XSS Payloads
## 2 Related Work  
Webmail XSS is a headache for the emails of major companies. In the past decade, almost all online Webmails have found XSS vulnerabilities. For example, Yahoo Webmail has exposed to storage XSS vulnerabilities twice in 2013 and 2016 [9], resulting in nearly 40 million users facing the risk of privacy breaches. Gmail was also exposed to XSS vulnerabilities many times between 2012 and 2014 [10]. Although they were repaired in time, it still caused a need for concern. As a subject of valuable research, XSS attack detection has achieved many results in recent years. Initially, most of XSS attack detection research was regular expression matching. In 2014, [PERSON] proposed a regular expressions detection method for HTTP requests [11], which focus on detecting SQLIA (SQL Injection Attacks) and XSS (Cross Site Scripting). In the experiment, the model can effectively run in benchmark CISC'10 database. In 2017, [PERSON] proposed a new payload recognition method [12], which investigated the XSS attack detection using regular expression pattern matching and a preprocessing method. [PERSON] built a security system (named Snort NIDC) that effective enough to detect and recognize the payload of XSS Attack, but he concluded that the system can only sufficient as the first defense barrier in the future. Therefore, the regular expression matching method has great limitations, and detection rate for complex or unknown XSS payloads is very low. To make up defects of regular matching, the industry established and expand XSS payloads sample libraries, but researchers began to use machine learning to solve problems. In 2019, [PERSON]'s team proposed an XSS attack detection framework based on machine learning [13]. They experimented with a variety of traditional machine learning algorithms, such as support vector machine, decision tree, naive bayesian and others. They proved that machine learning models can effectively identify XSS payloads. At the end of the article, [PERSON] found that if the word2 vec tool was used to retain the semantic relationship between the parts of the attack statement, the deep learning model had better results, and the recall rate reached 97.9%. Besides, [PERSON]'s team proposed a XSS attack detection method based on deep learning, which named DeepXSS [14]. They used word2 vec to extract payload features, and then used the LSTM algorithm to build the model. In the experiment, the recall of the model reached 0.98, which mean it had great ability to discovered XSS payload. The ideas and methods of [PERSON]'s paper had great reference value. However, it only performed simulation detection on the traditional XSS dataset, and did not research the actual data of specific Web applications in depth. Therefore, we paied more attention to XSS attack detection of Webmail and tried to optimize the deep learning model. China's [PERSON] proposed a Webmail-based XSS finder called L-WMxD [15]. It used a seed and syntax parser to construct numerous test cases in a form similar to fuzz. He inserted the constructed unique XSS statement into webmail to perform the attack, in anticipation of discovering XSS before the application's online service. In the experimental tests, vulnerabilities were discovered in 21 Webmail servers, including large companies such as Yahoo, Mirapoint, and Collaboration. The paper highlighted that most Webmails have had XSS vulnerabilities, especially those with weaker security. Regrettably, the model proposed in the article was more aggressive but did not provide more constructive advice on defensiveness. In the latest research, [PERSON]'s team proposed a vulnerability detection technology for the Webmail systems [16]. In the paper, it was considered that the XSS vulnerability is the most common and serious vulnerability in the current email systems. For XSS vulnerabilities, [PERSON] analyzed the possible injection points in Webmail, which provided theoretical support for our research.