# Providing Email Privacy by Preventing Webmail from Loading Malicious XSS Payloads
## 4 Email XSS Detection Framework
### Exact Feature  
To train the model through machine learning, one converts the email sample into a computer-readable digital format. The usual approach is to extract statistical features or word vectorization. Under our observation, we found that statistical features cannot describe well the differences between benign and malicious email samples. Since only a small piece of the email text contains the malicious code, the difference in statistical characteristics between benign and malicious email samples was few. Therefore, we used the word vectorization method to extract the feature of each email text, which paid more attention to the association between words.  
\begin{table}
\begin{tabular}{|c|c|c|} \hline  & **Source Code** & **After Replacement** \\ \hline Alphabet & \textless{}DIV\textless{}T\textless{}=”x:exPreSciOn(alErt(1))”\textgreater{} & \textless{}div\textless{}=”x:expression (alert(1))”\textgreater{} \\ upper/lower & IE6\textless{}/dIV\textgreater{} & IE6\textless{}/div\textgreater{} \\ \hline  & \textless{}img src=[[http://www.baidu.com/img/baidu](http://www.baidu.com/img/baidu)]([http://www.baidu.com/img/baidu](http://www.baidu.com/img/baidu))\_logo.gif” onload=’var s=document \textless{}:createElement(String.fromCharCode(115,9 9,114,105,112,116))s:type=String.fromChar & \textless{}img src=\"[[http://www.baidu.com/img/baidu](http://www.baidu.com/img/baidu)]([http://www.baidu.com/img/baidu](http://www.baidu.com/img/baidu))\_logo.gif\" onload=’var s=document.createElement(String.fromCharCode(script 116,101,120,116,47,106,97,118,97,115, ))s:type=String.fromCharCode(text) & \textless{})s.type=String.fromCharCode(text/java script)s.src=String.fromChar & \textless{}script)s.src=String.fromCharCode(http:// stunote.sinaapp.com/xss.js):document. body.appendChild(s);/\textgreater{} \\  & document.body.appendChild(s);/\textgreater{} \\ \hline \end{tabular}
\end{table}
Table 4: Equivalent Replacement Example for XSS Payload.  
\begin{table}
\begin{tabular}{c} \hline \hline \multicolumn{2}{c}{**Disturbing Characters**} \\ \hline \textbackslash{}n\textbackslash{}\backslash{}00\text{;}\%{}00\text{;}/{}^{*} \text{/;}\text{NewLine;}\text{...}\) \\ \hline \hline \end{tabular}
\end{table}
Table 5: Remove Disturbing Characters.  
Word2 Vec is a tool published by Google in 2013, which is specifically used for word vector computing. Word2 Vec has two major advantages: it can run efficiently in a million-level corpus; the word vector generated by training can also measure the relationship between words. Therefore, we decided to use Word2 Vec as a feature extraction tool for our email samples.  
First, we formed a corpus of processed benign and malicious samples. Then, we used Word2 Vec to train in the corpus and get the word vector for each word. Referring to [PERSON]'s research on XSS detection [25], we set the word vector dimension of Word2 Vec to 200. The word vector of the \"img\" is shown in Figure 3.  
Each word vector represents a feature of a word in the corpus. Since each word has the same dimensional features, we calculated the average of all word vectors in the sample as a final feature of each email sample. Lastly, the sample features are passed as input to the deep learning algorithm.