# Providing Email Privacy by Preventing Webmail from Loading Malicious XSS Payloads
## 1 Introduction  
The development of Internet has brought people closer together. Using email to deliver information has become one of the most common methods for communicating with others. Even large-scale enterprises commonly use Webmail to communicate between their employees. Due to the enormous daily workload and communication demands, a company will generate thousands of work-related emails each day. To meet the business demands, Webmail architecture has been optimized for enterprises since as early as 2007 [1]. After collecting information from enterprises, we found a phenomenon that is at risk. Many companies put too much trust in their internal framework and employees, so their network systems are often very simple and lack security [2]. The isolation of the intranet and the loyalty of employees help businesses believe that it is not worthwhile to invest in network security construction. But the reality demonstrates that networks security is needed. Actually, enterprises have experienced negative retaliation from a departing employee. There are many ways for hackers to enter the intranet [3, 4], such as a USB-Stick with viruses, social engineering, VPN, and so on. What is even worse, when hackers enter the company's internal network, it is easy for them to find network vulnerabilities. In fact, many enterprises have already experienced attacks on their Webmail systems. Due to the differences in business needs, the internal systems of a variety of enterprises face disparities. But the email system is an essential part of any enterprises framework. Business emails contain a wealth of information about work plans, personal privacy, corporate business, and confidentialattachments. Which makes the Webmail system extremely attractive for information theft [5]. The most common methods for email information stealing are phishing and XSS (Cross-Site Scripting) attacks. When a hacker successfully infects a host or connects to the intranet, he can start attacking from one node and send attack-emails to other users. The phishing email exploits the trust among the employees. As long as the employee's security awareness is improved, the email phishing attack can be effectively avoided. In fact, the phishing email detection is already an advanced technology, and many researchers have published the latest research results [6; 7; 8]. Therefore, for Webmail, the XSS email attack is still the most difficult way to be defended. Although XSS vulnerabilities are easy to exploit, defenders are constantly improving their detection methods. In the early days, simple regular expression matching was used to identify XSS payloads. However, defenders found it is difficult to describe complex XSS payloads just by regular expression. Therefore, they began to build the XSS attack \"sample library\", which repairs the defect of regular expression matching. These two methods can resist most known XSS attacks, but still cannot predict for new XSS attack methods. To identify unknown XSS attacks, researchers began to attempt with machine learning, such as Support Vector Machine (SVM), Random Forest, Long Short Term Memory (LSTM), and so forth. After analyzing many researchers' experiment, we found XSS detection is more inclined to natural language processing, so deep learning often performs better than traditional machine learning methods. Most mailbox security detections are focused on filtering junk emails and preventing attachment virus transmission. But they do not realize that the email system has become a severely affected area of the XSS vulnerability. Therefore, this paper applies XSS detection technology to email security detection, and proposes a method of email XSS detection based on deep learning. With the development of Webmail and the growing demand, many Webmails have been open to the Internet, which can be accessed by all users. These Webmails tend to be more secure and stable within the framework. In this paper, we used these Webmails as experimental objects.