Detection and mitigation of critical web vulnerabilities and attacks like
cross-site scripting (XSS), and cross-site request forgery (CSRF) have been a
great concern in the field of web security. Such web attacks are evolving and
becoming more challenging to detect. Several ideas from different perspectives
have been put forth that can be used to improve the performance of detecting
these web vulnerabilities and preventing the attacks from happening. Machine
learning techniques have lately been used by researchers to defend against XSS
and CSRF, and given the positive findings, it can be concluded that it is a
promising research direction. The objective of this paper is to briefly report
on the research works that have been published in this direction of applying
classical and advanced machine learning to identify and prevent XSS and CSRF.
The purpose of providing this survey is to address different machine learning
approaches that have been implemented, understand the key takeaway of every
research, discuss their positive impact and the downsides that persists, so
that it can help the researchers to determine the best direction to develop new
approaches for their own research and to encourage researchers to focus towards
the intersection between web security and machine learning.

本文提出一份调查报告，介绍机器学习应用于 Web 安全领域，以识别和防止 XSS 和 CSRF 攻击的研究进展，讨论了各种方法的优劣，以期帮助研究人员确定开发新方法的最佳方向并鼓励他们关注 Web 安全和机器学习的交集。

机器学习用于检测和缓解 Web 漏洞和 Web 攻击

Machine Learning for Detection and Mitigation of Web Vulnerabilities and  Web Attacks

Audio CAPTCHAs are supposed to provide a strong defense for online resources;
however, advances in speech-to-text mechanisms have rendered these defenses
ineffective. Audio CAPTCHAs cannot simply be abandoned, as they are
specifically named by the W3C as important enablers of accessibility.
Accordingly, demonstrably more robust audio CAPTCHAs are important to the
future of a secure and accessible Web. We look to recent literature on attacks
on speech-to-text systems for inspiration for the construction of robust,
principle-driven audio defenses. We begin by comparing 20 recent attack papers,
classifying and measuring their suitability to serve as the basis of new
"robust to transcription" but "easy for humans to understand" CAPTCHAs. After
showing that none of these attacks alone are sufficient, we propose a new
mechanism that is both comparatively intelligible (evaluated through a user
study) and hard to automatically transcribe (i.e., $P({\rm transcription}) = 4
\times 10^{-5}$). Finally, we demonstrate that our audio samples have a high
probability of being detected as CAPTCHAs when given to speech-to-text systems
($P({\rm evasion}) = 1.77 \times 10^{-4}$). In so doing, we not only
demonstrate a CAPTCHA that is approximately four orders of magnitude more
difficult to crack, but that such systems can be designed based on the insights
gained from attack papers using the differences between the ways that humans
and computers process audio.

本研究旨在针对当前文字型验证码安全性不足的情况，通过对语音识别技术的攻击论文进行比较分类，提出了一种基于容易理解但难以被自动转录的音频机制验证码来提升 Web 的安全及无障碍性，具有较高的可靠性和难以通过语音转文字技术识别等优势。