{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,10,27]],"date-time":"2026-10-27T04:09:52Z","timestamp":1793074192678,"version":"4.5.0"},"publisher-location":"Berlin, Heidelberg","reference-count":30,"publisher":"Springer Berlin Heidelberg","isbn-type":[{"value":"9783642044434","type":"print"},{"value":"9783642044441","type":"electronic"}],"license":[{"start":{"date-parts":[[2009,1,1]],"date-time":"2009-01-01T00:00:00Z","timestamp":1230768000000},"content-version":"tdm","delay-in-days":0,"URL":"http:\/\/www.springer.com\/tdm"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2009]]},"DOI":"10.1007\/978-3-642-04444-1_33","type":"book-chapter","created":{"date-parts":[[2009,9,14]],"date-time":"2009-09-14T18:34:44Z","timestamp":1252953284000},"page":"539-554","source":"Crossref","is-referenced-by-count":20,"title":["Client-Side Detection of XSS Worms by Monitoring Payload Propagation"],"prefix":"10.1007","author":[{"given":"Fangqi","family":"Sun","sequence":"first","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Liang","family":"Xu","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Zhendong","family":"Su","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"297","reference":[{"key":"33_CR1","unstructured":"Diminutive XSS worm replication contest (2008) http:\/\/sla.ckers.org\/forum\/read.php?2,18790,page=19"},{"key":"33_CR2","unstructured":"Ahmed, T.: The trigram algorithm, http:\/\/search.cpan.org\/dist\/String-Trigram\/Trigram.pm"},{"key":"33_CR3","unstructured":"Alexa. Top sites in United States, http:\/\/www.alexa.com\/topsites"},{"key":"33_CR4","first-page":"387","volume-title":"Proceedings of the IEEE Symposium on Security and Privacy","author":"D. Balzarotti","year":"2008","unstructured":"Balzarotti, D., Cova, M., Felmetsger, V., Jovanovic, N., Kirda, E., Kruegel, C., Vigna, G.: Saner: Composing static and dynamic analysis to validate sanitization in Web applications. In: Proceedings of the IEEE Symposium on Security and Privacy, pp. 387\u2013401. IEEE Computer Society Press, Los Alamitos (2008)"},{"key":"33_CR5","doi-asserted-by":"crossref","first-page":"39","DOI":"10.1145\/1455770.1455778","volume-title":"Proceedings of the 15th ACM conference on Computer and communications security","author":"W. Chang","year":"2008","unstructured":"Chang, W., Streiff, B., Lin, C.: Efficient and extensible security enforcement using dynamic data flow analysis. In: Proceedings of the 15th ACM conference on Computer and communications security, pp. 39\u201350. ACM Press, New York (2008)"},{"key":"33_CR6","doi-asserted-by":"crossref","unstructured":"Costa, M., Crowcroft, J., Castro, M., Rowstron, A., Zhou, L., Zhang, L., Barham, P.: Vigilante: End-to-End Containment of Internet Worms. In: Proceedings of the Symposium on Systems and Operating Systems Principles, pp. 133\u2013147 (2005)","DOI":"10.1145\/1095809.1095824"},{"key":"33_CR7","doi-asserted-by":"crossref","first-page":"235","DOI":"10.1145\/1102120.1102152","volume-title":"Proceedings of the 12th ACM conference on Computer and communications security","author":"J.R. Crandall","year":"2005","unstructured":"Crandall, J.R., Su, Z., Wu, S.F., Chong, F.T.: On deriving unknown vulnerabilities from zero-day polymorphic and metamorphic worm exploits. In: Proceedings of the 12th ACM conference on Computer and communications security, pp. 235\u2013248. ACM Press, New York (2005)"},{"key":"33_CR8","unstructured":"Edwards, D.: Dean Edwards Javascript packer, http:\/\/dean.edwards.name\/packer\/"},{"key":"33_CR9","unstructured":"Firebug, http:\/\/getfirebug.com\/"},{"key":"33_CR10","unstructured":"Gundy, M.V., Chen, H.: Noncespaces: using randomization to enforce information flow tracking and thwart cross-site scripting attacks. In: Proceedings of the 16th Annual Network and Distributed System Security Symposium (2009)"},{"key":"33_CR11","unstructured":"Hansen, R.: XSS cheat sheet, http:\/\/ha.ckers.org\/xss.html"},{"key":"33_CR12","doi-asserted-by":"crossref","unstructured":"Jim, T., Swamy, N., Hicks, M.: Defeating script injection attacks with Browser-Enforced Embedded Policies. In: WWW, pp. 601\u2013610 (2007)","DOI":"10.1145\/1242572.1242654"},{"key":"33_CR13","unstructured":"Kamkar, S.: The Samy worm (2005), http:\/\/namb.la\/popular\/tech.html"},{"key":"33_CR14","doi-asserted-by":"crossref","unstructured":"Kirda, E., Kruegel, C., Vigna, G., Jovanovic, N.: Noxes: A client-side solution for mitigating cross-site scripting attacks. In: SAC, pp. 330\u2013337 (2006)","DOI":"10.1145\/1141277.1141357"},{"key":"33_CR15","first-page":"32","volume-title":"Proceedings of the 2006 IEEE Symposium on Security and Privacy","author":"Z. Li","year":"2006","unstructured":"Li, Z., Sanghi, M., Chen, Y., Kao, M.-y., Chavez, B.: Hamsa: fast signature generation for zero-day polymorphic worms with provable attack resilience. In: Proceedings of the 2006 IEEE Symposium on Security and Privacy, pp. 32\u201347. IEEE Computer Society Press, Los Alamitos (2006)"},{"key":"33_CR16","doi-asserted-by":"crossref","unstructured":"Liang, Z., Sekar, R.: Fast and automated generation of attack signatures: A basis for building self-protecting servers. In: Proceedings of the 12th ACM conference on Computer and communications security (2005)","DOI":"10.1145\/1102120.1102150"},{"key":"33_CR17","unstructured":"Livshits, B., Cui, W.: Spectator: detection and containment of JavaScript worms. In: USENIX 2008 Annual Technical Conference on Annual Technical Conference, pp. 335\u2013348. USENIX Association (2008)"},{"key":"33_CR18","doi-asserted-by":"crossref","unstructured":"Louw, M.T., Venkatakrishnan, V.N.: Blueprint: Robust prevention of cross-site scripting attacks for existing browsers. In: Proceedings of the 30th IEEE Symposium on Security and Privacy (2009)","DOI":"10.1109\/SP.2009.33"},{"key":"33_CR19","unstructured":"Mozilla Corporation. Same origin policy for JavaScript, https:\/\/developer.mozilla.org\/En\/Same_origin_policy_for_JavaScript"},{"key":"33_CR20","unstructured":"Nadji, Y., Saxena, P., Song, D.: Document structure integrity: A robust basis for cross-site scripting defense. In: Proceedings of the 16th Annual Network and Distributed System Security Symposium (2009)"},{"key":"33_CR21","unstructured":"Newsome, J., Song, D.: Dynamic taint analysis for automatic detection, analysis, and signature generation of exploits on commodity software. In: Proceedings of the 12th Annual Network and Distributed System Security Symposium (2005)"},{"key":"33_CR22","unstructured":"OWASP, http:\/\/www.owasp.org"},{"key":"33_CR23","unstructured":"Sekar, R.: An efficient black-box technique for defeating Web application attacks. In: Proceedings of the 16th Annual Network and Distributed System Security Symposium (2009)"},{"key":"33_CR24","first-page":"372","volume-title":"Proceedings of the 33rd Annual Symposium on Principles of Programming Languages","author":"Z. Su","year":"2006","unstructured":"Su, Z., Wassermann, G.: The essence of command injection attacks in web applications. In: Proceedings of the 33rd Annual Symposium on Principles of Programming Languages, pp. 372\u2013382. ACM Press, New York (2006)"},{"key":"33_CR25","unstructured":"Symantec Corporation. Symantec Global Internet Security Threat Report, vol. XIII (2008)"},{"key":"33_CR26","unstructured":"W3C, http:\/\/www.w3.org\/"},{"key":"33_CR27","doi-asserted-by":"crossref","unstructured":"Wang, K., Cretu, G., Stolfo, S.J.: Anomalous payload-based worm detection and signature generation. In: Proceedings of the 8th International Symposium on Recent Advances in Intrusion Detection, pp. 227\u2013246 (2005)","DOI":"10.1007\/11663812_12"},{"key":"33_CR28","doi-asserted-by":"crossref","unstructured":"Wang, K., Parekh, J.J., Stolfo, S.J.: Anagram: A content anomaly detector resistant to mimicry attack. In: Proceedings of the 9th International Symposium on Recent Advances in Intrusion Detection, pp. 226\u2013248 (2006)","DOI":"10.1007\/11856214_12"},{"key":"33_CR29","first-page":"171","volume-title":"Proceedings of the 30th International Conference on Software Engineering","author":"G. Wassermann","year":"2008","unstructured":"Wassermann, G., Su, Z.: Static detection of cross-site scripting vulnerabilities. In: Proceedings of the 30th International Conference on Software Engineering, pp. 171\u2013180. ACM Press, New York (2008)"},{"key":"33_CR30","unstructured":"Xie, Y., Aiken, A.: Static detection of security vulnerabilities in scripting languages. In: Proceedings of the 15th conference on USENIX Security Symposium, USENIX Association (2006)"}],"container-title":["Lecture Notes in Computer Science","Computer Security \u2013 ESORICS 2009"],"original-title":[],"language":"en","link":[{"URL":"http:\/\/link.springer.com\/content\/pdf\/10.1007\/978-3-642-04444-1_33","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2021,10,10]],"date-time":"2021-10-10T18:09:51Z","timestamp":1633889391000},"score":1,"resource":{"primary":{"URL":"http:\/\/link.springer.com\/10.1007\/978-3-642-04444-1_33"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2009]]},"ISBN":["9783642044434","9783642044441"],"references-count":30,"URL":"https:\/\/doi.org\/10.1007\/978-3-642-04444-1_33","relation":{},"ISSN":["0302-9743","1611-3349"],"issn-type":[{"value":"0302-9743","type":"print"},{"value":"1611-3349","type":"electronic"}],"subject":[],"published":{"date-parts":[[2009]]}}}