In Japan, information security engineers are lacking. So, I am focused on artificial intelligence (AI) technology to solve the lack of human resources. And, I have developed the AI to detect vulnerabilities on web apps called SAIVS (Spider Artificial Intelligence Vulnerabilities Scanner). The goal of SAIVS is to obtain ability of equal or higher than vulnerability diagnosis members. Currently, SAIVS is prototype.
But, it is possible to detect vulnerabilities on web apps like a human.
1. It can crawl web apps.
SAIVS can crawl web apps that include dynamic pages such as "login," "create account".
For example, SAIVS recognizes the type of the page. If it crawls the login page without having a login credential, it creates login credential in the create account page. After it login with the created login credentials, it crawls the rest of the pages.
2. It can detect vulnerabilities.
SAIVS can detect vulnerabilities efficiently by observing the behavior of web apps.
For example, in the case of a reflected XSS, SAIVS recognizes the echoed back place of input value, and it can insert the exploitable tags and scripts that to match the HTML and JavaScript syntax. In addition, if the input value has been sanitized, SAIVS selects test pattern to avoid the sanitization, and it can inspect the XSS again.
I achieve these actions by simulate the thinking pattern of vulnerability diagnosis members using multiple machine learning algorithms.
My presentation will explain how this ability was made possible by the machine learning algorithms and show a demo (detecting reflected XSS).
--- Isao Takaesu
Web security engineer at Mitsui Bussan Secure Directions, Inc. CISSP.
I have worked on the detection of vulnerabilities on the web applications (web applications diagnosis) for seven years. In these days, I have been hoping to detect more vulnerabilities, but I feel the limitation of human resources. So, I am focused on the machine learning for web applications diagnosis, and have tried to develop the AI called SAIVS. In future, I really want SAIVS to take over my tasks of web applications diagnosis. Furthermore, SAIVS has been introduced at Black Hat Asia 2016 Arsenal at Singapore, and was well received.
[CB16] Method of detecting vulnerability in WebApps using Machine Learning by Isao Takaesu
1. CODE BLUE 2016
Presented by Isao Takaesu
Method of Detecting Vulnerability
in Web Apps
Using Machine Learning
2. About the speaker
• Occupation: Web security engineer
• Company: Mitsui Bussan Secure Directions
• Hobbies: Making scanners, Machine Learning
• Blog: http://www.mbsd.jp/blog/
• Presented in “Black Hat Asia 2016” Arsenal
• hosted “AISECjp”
Isao Takaesu
MBSD
(@bbr_bbq)
CODE BLUE 2016
3. Agenda
MBSD CODE BLUE 2016
1. Introduction
2. Objectives of research
3. Overview of SAIVS
4. Realized methods
5. Validation results
6. Demonstration
7. Future Prospects
8. MBSD CODE BLUE 2016
The first step is
Web application vulnerability assessment.
Objectives of research
9. What is web app vul assessment?
MBSD CODE BLUE 2016
Detect vulnerabilities on web apps.
10. MBSD
Security
engineer Web Server
Web Apps
Our company Client company
Pseudo-attack
Analyze response
CODE BLUE 2016
Performs pseudo-attacks while crawling the pages of web apps.
Analyzes the response and detects vulnerabilities.
What is web app vul assessment?
11. MBSD
Web Server
Web Apps
SQLi?
XSS?
CODE BLUE 2016
Our company Client company
Pseudo-attack
Analyze response
Security
engineer
Performs pseudo-attacks while crawling the pages of web apps.
Analyzes the response and detects vulnerabilities.
What is web app vul assessment?
12. Issues of web app vul assessment
MBSD CODE BLUE 2016
Depends on the skilled craftsmanship
of security engineers.
13. Our “GOAL”
Realize ALL MACHINE web app vulnerability assessment.
MBSD
The AI
Web Server
Web Apps
CODE BLUE 2016
Our company Client company
Pseudo-attack
Analyze response
SQLi?
XSS?
14. Overview of AI ”SAIVS”
MBSD
SAIVS
Spider Artificial Intelligence Vulnerability Scanner
CODE BLUE 2016
AI that performs web app vul assessment.
17. Importance of crawling
MBSD CODE BLUE 2016
Top Login
Register Confirm
Contact Us
My Page
Complete
vulnerability
Send
message
18. MBSD CODE BLUE 2016
Top Login
Register Confirm
Contact Us
My Page
Complete
It is necessary to log in correctly.
Importance of crawling
Send
message
19. MBSD CODE BLUE 2016
Top Login
Register Confirm
Contact Us
My Page
Complete
Importance of crawling.
It is necessary to register correctly.
Send
message
20. MBSD CODE BLUE 2016
Top Login
Register Confirm
Contact Us
My Page
Complete
It is important to exhaustively crawl pages.
Importance of crawling
Send
message
22. What is the type of this page ?
MBSD CODE BLUE 2016
Humans : Easily recognize the page type.
Machine : Difficult. (Log in? Register?)
23. What has just happened?
MBSD
Humans : Recognize failed crawling attempts from the message.
Machine : Difficult to interpret the message.
CODE BLUE 2016
24. What are your input values to crawl to the next page ?
MBSD
crawl
Humans : Input correct values in the form.
Machine : Difficult to interpret the meaning of the form.
???
???
???
???
???
CODE BLUE 2016
26. 3 requirements for crawling
MBSD
Recognize the page type
Recognize the success/fail of crawling
Input correct values in the forms
CODE BLUE 2016
29. MBSD CODE BLUE 2016
Each thinking pattern
implemented in machine learning.
Our approach
30. 3 requirements for crawling
MBSD CODE BLUE 2016
Recognize the page type
Recognize the success/fail of crawling
Input correct values in the forms
34. What is Naive Bayes?
Naive Bayes is used for auto classification of texts.
Uses pre-defined categories & laws of probability.
MBSD
examples)
Spam mail filter.
Classify blog post genres.
Improvement of defensive accuracy for WAF.
CODE BLUE 2016
35. MBSD
SPAM:0.672 ← Selected
HAM :0.03
limited
SPAM:40%
HAM :10%
Category
period
click
here
http://
wana.jp
SPAM:10%
HAM :30%
SPAM:70%
HAM :50%
SPAM:30%
HAM :40%
SPAM:80%
HAM :5%
Extracting a keyword from the mail text.
Example of the use of the spam e-mail filter.
CODE BLUE 2016
To calculate the probability of SPAM and HAM,
to select the probability is high category.
37. Page recognition by Naive Bayes
MBSD
<h1>Sign in</h1>
<form action="/cyclone/sessions" method="post">
<label for="email">Email</label>
<input id="email" name="email" type="text" />
<label for="password">Password</label>
<input id="password" name="password" type="password" />
</form>
Extracts keywords that characterize the page.
Excludes “Stop words”.
CODE BLUE 2016
38. Category table for page recognition
MBSD
Categories Keywords
Log in Email, User ID, Password, Sign in …
Register user Email, Password, Confirm, Sign up …
Search Word, Text, String, Sort, Search …
Purchase goods Credit, Account, Expire, Purchase …
Change password Password, Old Password, Change …
CODE BLUE 2016
Selects the category that contain the many keywords.
Keywords : Sign in, Email, Password
39. MBSD
Categories Keywords
Log in Email, User ID, Password, Sign in …
Register user Email, Password, Confirm, Sign up …
Search Word, Text, String, Sort, Search …
Purchase goods Credit, Account, Expire, Purchase …
Change password Password, Old Password, Change …
CODE BLUE 2016
“Log in” category contains many of the keywords.
⇒ The highest probability of the category "Log in".
Category table for page recognition
40. MBSD CODE BLUE 2016
This page is
recognized as ”Log in”.
Page recognition by Naive Bayes
41. 3 requirements for crawling
MBSD CODE BLUE 2016
Recognize the page type (✔)
Recognize the success/fail of crawling
Input correct values in the forms
42. MBSD CODE BLUE 2016
Recognition of page crawling success/fail by humans
43. MBSD CODE BLUE 2016
Recognition of page crawling success/fail by humans
Recognizes the keywords that characterize failure.
44. MBSD CODE BLUE 2016
Using Naive Bayes.
Recognition of page crawling success/fail by machines
45. MBSD CODE BLUE 2016
Recognition of page crawling success/fail by machines
46. MBSD
<h2>2 errors prohibited this user from being saved </h2>
<p>There were problems with these fields:</p>
<ul>
<li> Password doesn't match confirmation </li>
<li> Email is invalid </li>
["Password doesn't match confirmation","Email is invalid
"]
</ul>
CODE BLUE 2016
Extracts keywords that characterize failure.
Excludes “Stop words”.
Recognition of page crawling success/fail by machines
47. Category table for page crawling success/fail
MBSD
Categories Keywords
Success
good, valid, success, normal, fine, clean, nice,
can, match, confirmation, ok, finish, thank …
Failure
bad, invalid, failure, error, problem, unmatch,
doesn’t match, can’t, too, wrong, ng, blank …
CODE BLUE 2016
Selects the category that contain the many keywords.
Keywords : errors, problem, doesn’t match, invalid
48. MBSD
Categories Keywords
Success
good, valid, success, normal, fine, clean, nice,
can, match, confirmation, ok, finish, thank …
Failure
bad, invalid, failure, error, problem, wrong,
doesn’t match, can’t, too, ng, blank …
CODE BLUE 2016
“Failure“ category contains many of the keywords.
⇒ The highest probability of the category "Failure".
Category table for page crawling success/fail
49. MBSD CODE BLUE 2016
This is recognized as a
page transition ”failure”.
Recognize the success/fail of crawling by machines
50. 3 requirements for crawling
MBSD CODE BLUE 2016
Recognize the page type (✔).
Recognize the success/fail of crawling (✔).
Input correct values in the forms.
51. MBSD CODE BLUE 2016
Interprets the meaning of the form and inputs correct values.
crawl
Isao Takaesu
isao123@mbsd.jp
mbsd1234
mbsd1234
Inputting correct values by humans
52. MBSD CODE BLUE 2016
Using multilayer perceptron &
Q-Learning.
Inputting correct values by machines
53. What is multilayer perceptron(MLP)?
MBSD
examples)
Image recognition.
Hand-written number recognition.
CODE BLUE 2016
MLP is used for image recognition.
The model simulates the neural structure and function.
54. ・
・
・
・
・
・
・
・
・
Data Label
0
1
2
Training Data
Example of the use of the hand-written number recognition
CODE BLUE 2016MBSD
・
・
・
・
・
・
・
・
・
X₁
X₂
X784
X0
Y₁
Y₂
Y300
Y0
Z₁
Z₂
Z10
MLP
Learn
It can output the answer depending on the input data.
56. An algorithm that learns the best behavior of the agent.
Evaluates effectiveness of the behavior using the Q-value.
MBSD
examples)
Locomotive learning in robots.
Playing video games.
Route search.
CODE BLUE 2016
What is Q-Learning?
57. Example of the use of the locomotive learning in robots
MBSD CODE BLUE 2016
Agent
Environment
a1 Forward
a2 Left turn
a3 Right turn
a4 Backward
Action
State s
・・・
Next state s’
Policy
( a | s )
Transition probability
( s’ | s, a )
hole in the front
of the eye …
Reward r = R( s, a, s’ )
Task : The goal to avoid obstacles.
Learn the policies that total of reward is the maximum.
Update Q( s, a )
58. Model to attain correct input values
MBSD
Learns correct input values while attempting to crawl.
CODE BLUE 2016
・
・
・
・
・
・
Current page
MLP
Input values
Q-Learning
Next page
p1=abc, xyz・・・
p1=123, 12a・・・
p1=abc@xxx・・・
observe
state
evaluate
update
weight
59. MBSD CODE BLUE 2016
Model to attain correct input values
・
・
・
・
・
・
Current page
MLP
Input values
Q-Learning
Next page
p1=abc, xyz・・・
p1=123, 12a・・・
p1=abc@xxx・・・
observe
state
evaluate
update
weight
Learns correct input values while attempting to crawl.
60. Patterns of input value
MBSD
Pattern Input value
Char abc, abcdef, aBc, aBcdEf, ABCDEF …
Num 123, 12345, 4111111111111111 …
Char,Num abc123, 123abc, aBc123, 1a2b3c …
Char,Symbol abc!, abc!#$, abcdef!, abcdef!#$ …
Num,Symbol 123!, 123!#$, 12345!, !#$12345 …
Char,Num,Symbol abc123!, 123abc!, abc!123, !#$%&a1 …
Mail address abc@hoge.com, abc123@hoge.com …
CODE BLUE 2016
Set a combination of input values to the parameter.
Target : INPUT TYPE = text, password
61. MBSD
Inputs ”current" and "next" page to MLP.
CODE BLUE 2016
Learning flow
・
・
・
・
・
・
Current page
MLP
Input values
Q-Learning
Next page
p1=abc, xyz・・・
p1=123, 12a・・・
p1=abc@xxx・・・
observe
state
evaluate
update
weight
62. MBSD
Selects any input pattern from the input of MLP.
CODE BLUE 2016
Learning flow
・
・
・
・
・
・
Current page
MLP
Input values
Q-Learning
Next page
p1=abc, xyz・・・
p1=123, 12a・・・
p1=abc@xxx・・・
observe
state
evaluate
update
weight
63. MBSD
Attempts to crawl using the selected input pattern of MLP.
CODE BLUE 2016
Learning flow
・
・
・
・
・
・
Current page
MLP
Input values
Q-Learning
Next page
p1=abc, xyz・・・
p1=123, 12a・・・
p1=abc@xxx・・・
observe
state
evaluate
update
weight
64. MBSD
Observe the result of crawling.
CODE BLUE 2016
Learning flow
・
・
・
・
・
・
Current page
MLP
Input values
Q-Learning
Next page
p1=abc, xyz・・・
p1=123, 12a・・・
p1=abc@xxx・・・
observe
state
evaluate
update
weight
65. MBSD
Gives a reward depending on the result of crawling.
CODE BLUE 2016
Learning flow
・
・
・
・
・
・
Current page
MLP
Input values
Q-Learning
Next page
p1=abc, xyz・・・
p1=123, 12a・・・
p1=abc@xxx・・・
observe
state
evaluate
update
weight
66. MBSD
Update the weight of MLP using backpropagation.
CODE BLUE 2016
Learning flow
・
・
・
・
・
・
Current page
MLP
Input values
Q-Learning
Next page
p1=abc, xyz・・・
p1=123, 12a・・・
p1=abc@xxx・・・
observe
state
evaluate
update
weight
67. MBSD
Learning can be completed at approx. 300 attempts.
CODE BLUE 2016
Learning flow
・
・
・
・
・
・
Current page
MLP
Input values
Q-Learning
Next page
p1=abc, xyz・・・
p1=123, 12a・・・
p1=abc@xxx・・・
observe
state
evaluate
update
weight
70. Web apps for pre-training(one example).
MBSD
OWASP Broken Web Apps
CODE BLUE 2016
71. Training SAIVS
MBSD CODE BLUE 2016
BodgeIt peruggia WackoPicko Yazd
SAIVS
Web Apps
Attempts crawling & learning
⇒ Each 300 times
Achieves the correct input values for each form.
・・・
76. What is word2vec?
Calculation method for similar words in NLP.
A word is represented by a vector.
MBSD CODE BLUE 2016
examples)
Adding and subtracting words
word cos distance
email 0.956302
mail 0.927386
reply 0.920610
formula answer
Iraq - Violence Jordan
Human - Animal Ethics
Japan – Tokyo + France Paris
Similarity between words
Input : e-mail
77. Example of the use of the similarity calculation
MBSD CODE BLUE 2016
Calculate similarity using words around the word of interest.
Training data)
interpretation further. However, if anyone wishes to discuss this, I‘m certainly willing
(either offline - e-mail - or Stephen In article bevans@carina.unm.edu (Mathemagician)
writes: Just what do gay people do that straight・・・
carries archives of old alt.atheism.moderated articles and assorted other files. For more
information, send mail to archive-server@mantis.co.uk saying help send atheism/index
and it will mail back a reply. mathew An・・・
send mail to archive-server@mantis.co.uk saying help send atheism/index and it will
mail back a reply. mathew An Introduction to Atheism by Mathew. This article attempts
to provide a general introduction・・・
The similarity of the "e-mail", "mail", "reply" is high.
78. Word2vec training data
MBSD CODE BLUE 2016
The 20 Newsgroups data set.
A collection of newsgroups : about 20,000 news.
examples of newsgroup)
Computer(Graphics, MS-Windows, Hardware)
Science(Cryptography, Electronics, Space)
Hobby(Motorcycles, Baseball, Hockey)
79. MBSD CODE BLUE 2016
Windows Crypt Hardware Space
SAIVS
The 20 Newsgroups data set
Learns the similarity
Learns the similarity between the words.
word2vec
Training SAIVS
・・・
80. MBSD
candidate similarity
email 0.956302
mail 0.927386
E-mail 0.900249
address 0.893337
reply 0.865438
contact 0.846801
message 0.792930
chat 0.754903
newsgroup 0.747636
CODE BLUE 2016
candidate similarity
names 0.962508
username 0.939661
nickname 0.933694
naming 0.898254
surname 0.863966
initials 0.861093
firstname 0.849641
lastname 0.847604
title 0.782467
candidate similarity
homepage 0.794415
blog 0.752945
site 0.708534
webpage 0.701838
portal 0.701374
forum 0.692067
com 0.641086
archive 0.537914
org 0.531096
Extracts candidate words of Top 10.
Learned similarities in the training
Target :websiteTarget :nameTarget : e-mail
81. MBSD
candidate similarity
email 0.956302
mail 0.927386
E-mail 0.900249
address 0.893337
reply 0.865438
contact 0.846801
message 0.792930
chat 0.754903
newsgroup 0.747636
CODE BLUE 2016
candidate similarity
names 0.962508
username 0.939661
nickname 0.933694
naming 0.898254
surname 0.863966
initials 0.861093
firstname 0.849641
lastname 0.847604
title 0.782467
candidate similarity
homepage 0.794415
blog 0.752945
site 0.708534
webpage 0.701838
portal 0.701374
forum 0.692067
com 0.641086
archive 0.537914
org 0.531096
Selects a candidate word that matches the form string of training.
Learned similarities in the training
Target :websiteTarget :nameTarget : e-mail
82. MBSD
candidate similarity
email 0.956302
mail 0.927386
E-mail 0.900249
address 0.893337
reply 0.865438
contact 0.846801
message 0.792930
chat 0.754903
newsgroup 0.747636
CODE BLUE 2016
candidate similarity
names 0.962508
username 0.939661
nickname 0.933694
naming 0.898254
surname 0.863966
initials 0.861093
firstname 0.849641
lastname 0.847604
title 0.782467
candidate similarity
homepage 0.794415
blog 0.752945
site 0.708534
webpage 0.701838
portal 0.701374
forum 0.692067
com 0.641086
archive 0.537914
org 0.531096
Learned similarities in the training
Target :websiteTarget :nameTarget : e-mail
⇒ abc@hoge.com ⇒ aBcdEf ⇒ http://hoge.com
83. MBSD CODE BLUE 2016
3 requirements for crawling
Recognize the page type (✔).
Recognize the success/fail of crawling (✔).
Input correct values in the forms (✔).
85. MBSD CODE BLUE 2016
Top Login
Register Confirm
User Search
Complete
1.Create a login account in "register".
2.Log in.
3.Search users.
Demonstration of crawling
vulnerability
86. MBSD CODE BLUE 2016
Top Login
Register Confirm
User Search
Complete
1.Create a login account in "register".
2.Log in.
3.Search users.
Demonstration of crawling
87. MBSD CODE BLUE 2016
Top Login
Register Confirm
User Search
Complete
1.Create a login account in "register".
2.Log in.
3.Search users.
Demonstration of crawling
88. MBSD CODE BLUE 2016
Top Login
Register Confirm
User Search
Complete
Demonstration of crawling
1.Create a login account in "register".
2.Log in.
3.Search users.
89. MBSD CODE BLUE 2016
Top Login
Register Confirm
User Search
Complete
1.Create login account in "register".
2.Log in.
3.Search users.
Demonstration of crawling
92. MBSD CODE BLUE 2016
To detect vulnerabilities with less trouble.
Objective of this research
93. MBSD CODE BLUE 2016
There are many web application
vulnerabilities...
94. MBSD CODE BLUE 2016
Reflected Cross-Site Scripting
(RXSS)
Target vulnerability of this research
95. Example of RXSS Pattern 1:very vulnerable web app
MBSD
<html>
<head>
<meta http-equiv="Content-Type" content="text/html">
<title>Case 3 - RXSS</title>
</head>
<body>
<input type="text" value="testData">
</body>
</html>
http://xxx/case3/?input=testData
Input value is echoed in the "VALUE" attribute of the INPUT tag.
CODE BLUE 2016
96. MBSD
<html>
<head>
<meta http-equiv="Content-Type" content="text/html">
<title>Case 3 - RXSS</title>
</head>
<body>
<input type="text"
value=""/><script>alert('XSS');</script>">
</body>
</html>
http://xxx/case3/?input="/><script>alert(‘XSS');</script>
JavaScript is inserted in the HTML syntax.
CODE BLUE 2016
Example of RXSS Pattern 1:attacking a web app
97. Example of RXSS Pattern 2:a little more secure web app
MBSD
<html>
<head>
<meta http-equiv="Content-Type" content="text/html">
<title>Case 4 - RXSS</title>
</head>
<body>
<input type="text" value=""/> alert('XSS');">
</body>
</html>
SCRIPT tag is sanitized by the web app.
http://xxx/case4/?input="/><script>alert(‘XSS');</script>
CODE BLUE 2016
98. Example of RXSS Pattern 2:attacking web app
MBSD
<html>
<head>
<meta http-equiv="Content-Type" content="text/html">
<title>Case 4 - RXSS</title>
</head>
<body>
<input type="text" value=""onmouseout=alert('XSS')"">
</body>
</html>
JavaScript is inserted to avoid sanitization.
http://xxx/case4/?input=“onmouseout=alert(‘XSS')”
CODE BLUE 2016
99. MBSD
Understanding HTML syntax.
Understanding JavaScript syntax.
Avoiding sanitization.
CODE BLUE 2016
3 requirements for detecting RXSS
105. What is LSTM(Long-Short Term Memory)?
It can learn chronological data.
It can learn dependencies in short & long term data.
MBSD
examples)
Machine translation.
Text generation. (novel, lyrics, source code)
Sound generation. (music, human voice)
CODE BLUE 2016
106. What is LSTM(Long-Short Term Memory)?
It can learn chronological data.
It can learn dependencies in short & long term data.
MBSD
examples)
Machine translation.
Text generation. (novel, Lyrics, source code)
Sound generation. (music, human voice)
CODE BLUE 2016
107. Example of the use of the text generation.
MBSD CODE BLUE 2016
Generation of source code.(from Andrej Karpathy blog)
static int indicate_policy(void)
{
int error;
if (fd == MARN_EPT) {
if (ss->segment < mem_total)
unblock_set_blocked();
else
ret = 1;
goto bail;
}
segaddr = in_SB(in.addr);
selector = seg / 16;
・・・
Training Data
static void settings(struct *tty)
{
if (tty == tty)
disable_single_st_p(dev);
pci_disable_spool(port);
return 0;
}
static void command(struct seq_file *m)
{
int column = 32 << (cmd[2] & 0x80);
if (state)
・・・
Generated source code by LSTM
It can generate a code from the starting point (seed).
108. Why LSTM?
MBSD
<!doctype html><html><head><title>Reflected XSS in
textarea (textarea1)</title></head><body>
<H2>Textarea injection test</H2>
<FORM>
<textarea name="in" rows="5" cols="60">xxx</textarea>
・・・
http://xxx/textarea1?in=xxx
CODE BLUE 2016
Input value is echoed in the TEXTAREA tag.
109. MBSD
<!doctype html><html><head><title>Reflected XSS in
textarea (textarea1)</title></head><body>
<H2>Textarea injection test</H2>
<FORM>
<textarea name="in" rows="5" cols="60">
<script>alert('XSS');</script></textarea>
・・・
http://xxx/textarea1?in=<script>alert(‘XSS’);</script>
JavaScript doesn’t run.
⇒ Simple script injection is not allowed.
CODE BLUE 2016
Why LSTM?
110. MBSD
<!doctype html><html><head><title>Reflected XSS in
textarea (textarea1)</title></head><body>
<H2>Textarea injection test</H2>
<FORM>
<textarea name="in" rows="5" cols="60">xxx</textarea>
・・・
http://xxx/textarea1?in=xxx
“Is JavaScript inserted after closing the TEXTAREA tag ?”
CODE BLUE 2016
Why LSTM?
111. MBSD
<!doctype html><html><head><title>Reflected XSS in
textarea (textarea1)</title></head><body>
<H2>Textarea injection test</H2>
<FORM>
<textarea name="in" rows="5"
cols="60"></textarea><script>alert('XSS');</script></t
extarea>
・・・
http://xxx/textarea1?in=</textarea><script>alert(‘XSS’);</script>
CODE BLUE 2016
Understands the context of HTML and inserts a script.
⇒ JavaScript run.
Why LSTM?
114. MBSD
_satellite.pageBottom();']
(function(window) {
var _gaq = _gaq || [];
var methods = ['log', 'dir', 'trace'];
if (typeof window.console === 'undefined') {
window.console = {};
}
for (var i in methods) {
if (!(methods[i] in window.console)) {
window.console[methods[i]] = function() {};
}
}
}(window));
CODE BLUE 2016
10,000 pages of JavaScript syntax.
Learning data for LSTM (JavaScript)
115. Generated syntax by learned LSTM (one example)
MBSD
Seed Generated syntax
<textarea cols="60">xxx </textarea>
<!– mbsdtest xxx -->
<input type="" value=“xxx ">
var hoge = ['log', ‘xxx red’];¥r¥n
/* mbsdtest xxx */
function(){ xxx }¥r¥n
CODE BLUE 2016
It can generate a syntax from the seeds.
116. MBSD
Understanding HTML syntax (✔).
Understanding JavaScript syntax (✔).
Avoiding sanitization.
CODE BLUE 2016
3 requirements for detecting RXSS
117. Avoidance of sanitization by machines
MBSD CODE BLUE 2016
Using Multilayer perceptron &
Q-Learning.
118. MBSD
・
・
・
・
・
・
attribute
JS
・・・
Output point
MLP
Out of tag
“sCriPt”
Other tag
URL
encode
Test pattern
Event
handler
・
・
・
Q-Learning
Model to avoid sanitization
・
・
・
“ ⇒ "
< ⇒ <
・・・
Sanitize
> ⇒ >
Learns the pattern of avoiding sanitization while attempting to test.
CODE BLUE 2016
observe
state
evaluate
update
weight
119. MBSD
・
・
・
・
・
・
attribute
JS
・・・
Output point
MLP
Out of tag
“sCriPt”
Other tag
URL
encode
Test pattern
Event
handler
・
・
・
Q-Learning
Model to avoid sanitization.
・
・
・
“ ⇒ "
< ⇒ <
・・・
Sanitize
> ⇒ >
CODE BLUE 2016
observe
state
evaluate
update
weight
120. Patterns of Output point
MBSD
Output point Example
attribute value :「”」 <~value="xxx">
attribute value :「'」 <~value='xxx'>
attribute value : noquote <~value=xxx>
JavaScript <script>xxx</script>
outside of HTML tags <~>xxx</~>
CODE BLUE 2016
121. MBSD CODE BLUE 2016
Model to avoid sanitization
・
・
・
・
・
・
attribute
JS
・・・
Output point
MLP
Out of tag
“sCriPt”
Other tag
URL
encode
Test pattern
Event
handler
・
・
・
Q-Learning
・
・
・
“ ⇒ "
< ⇒ <
・・・
Sanitize
> ⇒ >
observe
state
evaluate
update
weight
123. MBSD CODE BLUE 2016
Model to avoid sanitization
・
・
・
・
・
・
attribute
JS
・・・
Output point
MLP
Out of tag
“sCriPt”
Other tag
URL
encode
Test pattern
Event
handler
・
・
・
Q-Learning
・
・
・
“ ⇒ "
< ⇒ <
・・・
Sanitize
> ⇒ >
observe
state
evaluate
update
weight
124. Test patterns(one example)
MBSD
Output point Test pattern
attribute value :「”」
attribute value :「'」
attribute value : noquote
outside of HTML tags
“event handler
"><sCriPt>xxx
"><img src=xxx
‘event handler
‘><sCriPt>xxx
<svg/onload=alert()>
<sCriPt>xxx</sCriPt>
JavaScript
";alert();//
[CR][LF]alert();
¥";alert();//
CODE BLUE 2016
125. MBSD
Inputs ”Output point" and "pattern of sanitization" to MLP.
CODE BLUE 2016
・
・
・
・
・
・
attribute
JS
・・・
Output point
MLP
Out of tag
“sCriPt”
Other tag
URL
encode
Test pattern
Event
handler
・
・
・
Q-Learning
・
・
・
“ ⇒ "
< ⇒ <
・・・
Sanitize
> ⇒ >
observe
state
evaluate
update
weight
Learning flow
126. MBSD CODE BLUE 2016
・
・
・
・
・
・
attribute
JS
・・・
Output point
MLP
Out of tag
“sCriPt”
Other tag
URL
encode
Test pattern
Event
handler
・
・
・
Q-Learning
・
・
・
“ ⇒ "
< ⇒ <
・・・
Sanitize
> ⇒ >
observe
state
evaluate
update
weight
Learning flow
Selects any test pattern from the input of MLP.
127. MBSD CODE BLUE 2016
・
・
・
・
・
・
attribute
JS
・・・
Output point
MLP
Out of tag
“sCriPt”
Other tag
URL
encode
Test pattern
Event
handler
・
・
・
Q-Learning
・
・
・
“ ⇒ "
< ⇒ <
・・・
Sanitize
> ⇒ >
observe
state
evaluate
update
weight
Learning flow
Attempts to test using the selected test pattern of MLP.
128. MBSD CODE BLUE 2016
・
・
・
・
・
・
attribute
JS
・・・
Output point
MLP
Out of tag
“sCriPt”
Other tag
URL
encode
Test pattern
Event
handler
・
・
・
Q-Learning
・
・
・
“ ⇒ "
< ⇒ <
・・・
Sanitize
> ⇒ >
observe
state
evaluate
update
weight
Learning flow
Observe the result of the test.
129. MBSD CODE BLUE 2016
・
・
・
・
・
・
attribute
JS
・・・
Output point
MLP
Out of tag
“sCriPt”
Other tag
URL
encode
Test pattern
Event
handler
・
・
・
Q-Learning
・
・
・
“ ⇒ "
< ⇒ <
・・・
Sanitize
> ⇒ >
observe
state
evaluate
update
weight
Learning flow
Gives a reward depending on the result of the test.
130. MBSD CODE BLUE 2016
・
・
・
・
・
・
attribute
JS
・・・
Output point
MLP
Out of tag
“sCriPt”
Other tag
URL
encode
Test pattern
Event
handler
・
・
・
Q-Learning
・
・
・
“ ⇒ "
< ⇒ <
・・・
Sanitize
> ⇒ >
observe
state
evaluate
update
weight
Learning flow
Update the weight of MLP using backpropagation.
131. MBSD CODE BLUE 2016
・
・
・
・
・
・
attribute
JS
・・・
Output point
MLP
Out of tag
“sCriPt”
Other tag
URL
encode
Test pattern
Event
handler
・
・
・
Q-Learning
・
・
・
“ ⇒ "
< ⇒ <
・・・
Sanitize
> ⇒ >
observe
state
evaluate
update
weight
Learning flow.
Learning is completed at approx. 100 attempts.
134. MBSD
WAVSEP
CODE BLUE 2016
ReflectedXSS GET Input Vector
Case06 output :SRC attr value of IMG tag.
sanitize :< , > ⇒ < , >
testing value:"onmouseover=alert(3122);"
Case10 output :onClick value of SCRIPT tag.
sanitize :“ , < , > ⇒ " , < , >
testing value:';alert(3122);//
Case27 output :single line comment of JavaScript
sanitize :comment out
testing value:[CR][LF]alert(3122);//
Web Apps for pre-training(one example).
135. MBSD CODE BLUE 2016
Case06 Case08 Case10 Case27
SAIVS
WAVSEP
Achieve the best test string to avoid each sanitize pattern.
Training SAIVS
Attempts testing & learning
⇒ Each 100 times.
・・・
136. MBSD
Understanding HTML syntax (✔).
Understanding JavaScript syntax (✔).
Avoiding sanitization (✔).
CODE BLUE 2016
3 requirements for detecting RXSS
137. MBSD
Test flow of SAIVS
Primary inspection.
Secondary inspection.
CODE BLUE 2016
138. Sends normal request to examine the output point.
MBSD
Web Server
Web Apps
SAIVS
Sends normal request
CODE BLUE 2016
Primary inspection
139. Recognizes the output point of the input value.
MBSD
Web Server
Web Apps
SAIVS
Sends normal request
Analyzes response
CODE BLUE 2016
<~value="xxx">
Primary inspection.
140. Extracts the seed based on the output point.
MBSD
Web Server
Web Apps
SAIVS
CODE BLUE 2016
<~value="xxx">
Primary inspection
Sends normal request
Analyzes response
141. Generates HTML / JavaScript syntax
from the seed. (using learned LSTM)
MBSD
Web Server
Web Apps
SAIVS
CODE BLUE 2016
<~value=“”>
Primary inspection
Sends normal request
Analyzes response
142. Adds the script to the generated HTML syntax.
MBSD
Web Server
Web Apps
SAIVS
CODE BLUE 2016
<~value=“”><script>alert(3122);</script>
Primary inspection
Analyzes response
Sends normal request
143. Sends test request to detect RXSS.
MBSD
Web Server
Web Apps
SAIVS
Sends test request
CODE BLUE 2016
<~value=“”><script>alert(3122);</script>
Primary inspection
144. Determines the presence or absence of RXSS.
RXSS detected ⇒ Test finishes.
Not detected⇒ Secondary inspection.
MBSD
Web Server
Web Apps
SAIVS
CODE BLUE 2016
RXSS?
Analyzes response
Sends test request
Primary inspection
145. Recognizes the sanitizing pattern.
MBSD
Web Server
Web Apps
SAIVS
CODE BLUE 2016
<~value=“”><script>alert(3122);・・・
Secondary inspection
Analyzes response
Sends test request
146. Selects the test pattern to avoid sanitization.
(Using learned MLP)
MBSD
Web Server
Web Apps
SAIVS
CODE BLUE 2016
Event handler?
Secondary inspection
Analyzes response
Sends test request
147. Sends the test request to avoid sanitization.
MBSD
Web Server
Web Apps
SAIVS
CODE BLUE 2016
Event handler?
Secondary inspection
Resends test request
148. MBSD
Web Server
Web Apps
SAIVS
CODE BLUE 2016
Secondary inspection
Analyzes response
Sends test request
RXSS?
Determines presence or absence of RXSS.
RXSS detected ⇒ Test finishes.
Not detected ⇒ Repeat secondary inspection.
149. Demonstration of detecting RXSS
MBSD
Target:webseclab
CODE BLUE 2016
Case Overview
/reflect/full1
output : BODY tag
sanitize : none
/reflect/textarea1
output : TEXTAREA tag
sanitize : none
/reflect/onmouseover
output : attribute value of INPUT tag
sanitize : exclude “</script>”
/reflect/js4_dq
output : SCRIPT tag
sanitize : none
150. Demonstration of detecting RXSS
MBSD
Target:webseclab
CODE BLUE 2016
Case Overview
/reflect/full1
output : BODY tag
sanitize : none
/reflect/textarea1
output : TEXTAREA tag
sanitize : none
/reflect/onmouseover
output : attribute value of INPUT tag
sanitize : exclude “</script>”
/reflect/js4_dq
output : SCRIPT tag
sanitize : none
151. MBSD
<!doctype html><html><head><title>Full Javascript
Injection (full.1)</title></head><body>
Hello!<BR>
The value of cgi parameter "in"
is:saivs12345
</body></html>
http://xxx/reflect/full1?in=saivs12345
output :BODY tag
sanitize : None
Case1:Sending normal request
CODE BLUE 2016
152. MBSD
<!doctype html><html><head><title>Full Javascript
Injection (full.1)</title></head><body>
Hello!<BR>
The value of cgi parameter "in" is:
lasther=''></form>D0i7Q"VW53N'nT7t0<script>alert(3122)
;kc5i3</script>ueFj8
</body></html>
http://xxx/reflect/full1?in=lasther=''%3E%3C/form%3ED0i7Q%22VW
53N'nT7t0%3Cscript%3Ealert(3122);kc5i3%3C/script%3EueFj8
attempted times:1
Case1:Sending test request
CODE BLUE 2016
154. Demonstration of detecting RXSS
MBSD
Target:webseclab
CODE BLUE 2016
Case Overview
/reflect/full1
output : BODY tag
sanitize : none
/reflect/textarea1
output : TEXTAREA tag
sanitize : none
/reflect/onmouseover
output : attribute value of INPUT tag
sanitize : exclude “</script>”
/reflect/js4_dq
output : SCRIPT tag
sanitize : none
155. MBSD
<!doctype html><html><head><title>Reflected XSS in
textarea (textarea1)</title></head><body>
<H2>Textarea injection test</H2>
<p>
<FORM>
<textarea name="in" rows="5" cols="60">saivs12345
</textarea>
<p>
http://xxx/reflect/textarea1?in=saivs12345
CODE BLUE 2016
Case2:Sending normal request
output :TEXTAREA tag
sanitize : None
156. MBSD
<!doctype html><html><head><title>Reflected XSS in
textarea (textarea1)</title></head><body>
<H2>Textarea injection test</H2>
<p>
<FORM>
<textarea name="in" rows="5" cols="60"></textarea>7Q7p
N"MBPcc'PA6tz<script>alert(3122);WKr8J</script>fowCP</
textarea>
<p>
http://xxx/reflect/textarea1?in=%3C/textarea%3E7Q7pN%22MBPcc'
PA6tz%3Cscript%3Ealert(3122);WKr8J%3C/script%3EfowCP
CODE BLUE 2016
Case2:Sending test request
attempted times:1
158. Demonstration of detecting RXSS
MBSD
Target:webseclab
CODE BLUE 2016
Case Overview
/reflect/full1
output : BODY tag
sanitize : none
/reflect/textarea1
output : TEXTAREA tag
sanitize : none
/reflect/onmouseover
output : attribute value of INPUT tag
sanitize : exclude “</script>”
/reflect/js4_dq
output : SCRIPT tag
sanitize : none
159. MBSD
<!doctype html><html>
<head><title>Reflected XSS - attribute injection in ta
gs (dq.2)</title></head><body>
<H2>Update Your Preferences</H2><p>
<FORM>
Homepage: <input value=""><script>alert()" name="in" s
ize="40"><BR>
http://xxx/xss/reflect/onmouseover?in=”><script>alert()</script>
CODE BLUE 2016
Case 3:Sending normal request
output :INPUT tag
sanitize : exclude “</script>”
160. MBSD
<!doctype html><html>
<head><title>Reflected XSS - attribute injection in
tags (dq.2)</title></head><body>
<H2>Update Your Preferences</H2><p>
<FORM>
Homepage: <input value=""> <option s onmouseover=alert
(3122);//" name="in" size="40"><BR>
http://xxx/xss/reflect/onmouseover?in=%22%3E%3C/option%3E%3
Coption%20s%20onmouseover=alert(3122);//
CODE BLUE 2016
Case 3:Sending test request.
attempted times:3
162. Demonstration of detecting RXSS
MBSD
Target:webseclab
CODE BLUE 2016
Case Overview
/reflect/full1
output : BODY tag
sanitize : none
/reflect/textarea1
output : TEXTAREA tag
sanitize : none
/reflect/onmouseover
output : attribute value of INPUT tag
sanitize : exclude “</script>”
/reflect/js4_dq
output : SCRIPT tag
sanitize : none
163. MBSD
<!doctype html><html><head><title>JavaScript and
double-quote injection in JS block (js.4)</title>
</head><body>
<script language="javascript">
var f = {
date: "",
week: "1",
bad: "saivs12345",
phase: "2",
http://xxx/xss/reflect/js4_dq?in=saivs12345
CODE BLUE 2016
Case 4:Sending normal request
output :SCRIPT tag
sanitize : None
164. MBSD
<!doctype html><html><head><title>JavaScript and
double-quote injection in JS block (js.4)</title>
</head><body>
<script language="javascript">
var f = {
date: "",
week: "1",
bad: "6",
skuI;alert(3122);//1VU7k",
phase: "2",
http://xxx/xss/reflect/js4_dq?in=6%22,%0A%20%20%20%20%20%20
%20%20%20%20%20%20skuI;alert(3122);//1VU7k
CODE BLUE 2016
Case 4:Sending test request
attempted times:1
169. MBSD CODE BLUE 2016
Top Sign up
Login New snippet
Sign up
complete
1.Create an account in “Sign up”.
2.Log in.
3.Register Snippet.
4.Update Profile.
Profile
New snippet
register
Profile
update
Demonstration of SAIVS
vulnerability
170. MBSD CODE BLUE 2016
Top Sign up
Login New snippet
Sign up
complete
Profile
New snippet
register
Profile
update
1.Create an account in “Sign up”.
2.Log in.
3.Register Snippet.
4.Update Profile.
Demonstration of SAIVS
171. MBSD CODE BLUE 2016
Top Sign up
Login New snippet
Sign up
complete
Profile
New snippet
register
Profile
update
Demonstration of SAIVS
1.Create an account in “Sign up”.
2.Log in.
3.Register Snippet.
4.Update Profile.
172. MBSD CODE BLUE 2016
Top Sign up
Login New snippet
Sign up
complete
Profile
New snippet
register
Profile
update
Demonstration of SAIVS
1.Create an account in “Sign up”.
2.Log in.
3.Register Snippet.
4.Update Profile.
173. MBSD CODE BLUE 2016
Top Sign up
Login
Sign up
complete
Profile Profile
update
New snippet
New snippet
register
Demonstration of SAIVS
1.Create an account in “Sign up”.
2.Log in.
3.Register Snippet.
4.Update Profile.
174. MBSD CODE BLUE 2016
Function name Overview
New snippet register
output : BODY tag
sanitize : exclude SCRIPT tag
Profile update
output : A tag
sanitize : < , > ⇒ < , >
Demonstration of SAIVS
176. MBSD
Strengthening the page crawling capability.
Responding to complex web apps.
Responding to CAPTCHA.
CODE BLUE 2016
Future prospects
Strengthening the detecting vulnerabilities capability.
Responding to complex RXSS patterns.
Responding to other vulnerabilities.
177. • Download “.PDF” version of this document:
≫ http://www.mbsd.jp
MBSD
Notas del editor
My name is / Isao Takaesu.
I’m a web security engineer / at a Japanese security company / called MBSD.
LSTM can simulate long term memory and short term memory of humans.
And, It can grasp relation of some contexts in documents.
It's used machine translation and text generation.
For example, DeepDazai can output novel like a Osamu Dazai.
It is very interesting.
LSTM can simulate long term memory and short term memory of humans.
And, It can grasp relation of some contexts in documents.
It's used machine translation and text generation.
For example, DeepDazai can output novel like a Osamu Dazai.
It is very interesting.
LSTM can simulate long term memory and short term memory of humans.
And, It can grasp relation of some contexts in documents.
It's used machine translation and text generation.
For example, DeepDazai can output novel like a Osamu Dazai.
It is very interesting.
LSTM can simulate long term memory and short term memory of humans.
And, It can grasp relation of some contexts in documents.
It's used machine translation and text generation.
For example, DeepDazai can output novel like a Osamu Dazai.
It is very interesting.
Detail, I use two machine learning algorithms.
It’s called LSTM and Q-Learning.
Detail, I use two machine learning algorithms.
It’s called LSTM and Q-Learning.
Detail, I use two machine learning algorithms.
It’s called LSTM and Q-Learning.
LSTM can simulate long term memory and short term memory of humans.
And, It can grasp relation of some contexts in documents.
It's used machine translation and text generation.
For example, DeepDazai can output novel like a Osamu Dazai.
It is very interesting.
LSTM can simulate long term memory and short term memory of humans.
And, It can grasp relation of some contexts in documents.
It's used machine translation and text generation.
For example, DeepDazai can output novel like a Osamu Dazai.
It is very interesting.
LSTM can simulate long term memory and short term memory of humans.
And, It can grasp relation of some contexts in documents.
It's used machine translation and text generation.
For example, DeepDazai can output novel like a Osamu Dazai.
It is very interesting.
LSTM can simulate long term memory and short term memory of humans.
And, It can grasp relation of some contexts in documents.
It's used machine translation and text generation.
For example, DeepDazai can output novel like a Osamu Dazai.
It is very interesting.
LSTM can simulate long term memory and short term memory of humans.
And, It can grasp relation of some contexts in documents.
It's used machine translation and text generation.
For example, DeepDazai can output novel like a Osamu Dazai.
It is very interesting.
LSTM can simulate long term memory and short term memory of humans.
And, It can grasp relation of some contexts in documents.
It's used machine translation and text generation.
For example, DeepDazai can output novel like a Osamu Dazai.
It is very interesting.
Detail, I use two machine learning algorithms.
It’s called LSTM and Q-Learning.
LSTM can simulate long term memory and short term memory of humans.
And, It can grasp relation of some contexts in documents.
It's used machine translation and text generation.
For example, DeepDazai can output novel like a Osamu Dazai.
It is very interesting.
LSTM can simulate long term memory and short term memory of humans.
And, It can grasp relation of some contexts in documents.
It's used machine translation and text generation.
For example, DeepDazai can output novel like a Osamu Dazai.
It is very interesting.
LSTM can simulate long term memory and short term memory of humans.
And, It can grasp relation of some contexts in documents.
It's used machine translation and text generation.
For example, DeepDazai can output novel like a Osamu Dazai.
It is very interesting.
LSTM can simulate long term memory and short term memory of humans.
And, It can grasp relation of some contexts in documents.
It's used machine translation and text generation.
For example, DeepDazai can output novel like a Osamu Dazai.
It is very interesting.
LSTM can simulate long term memory and short term memory of humans.
And, It can grasp relation of some contexts in documents.
It's used machine translation and text generation.
For example, DeepDazai can output novel like a Osamu Dazai.
It is very interesting.
LSTM can simulate long term memory and short term memory of humans.
And, It can grasp relation of some contexts in documents.
It's used machine translation and text generation.
For example, DeepDazai can output novel like a Osamu Dazai.
It is very interesting.
LSTM can simulate long term memory and short term memory of humans.
And, It can grasp relation of some contexts in documents.
It's used machine translation and text generation.
For example, DeepDazai can output novel like a Osamu Dazai.
It is very interesting.
LSTM can simulate long term memory and short term memory of humans.
And, It can grasp relation of some contexts in documents.
It's used machine translation and text generation.
For example, DeepDazai can output novel like a Osamu Dazai.
It is very interesting.
LSTM can simulate long term memory and short term memory of humans.
And, It can grasp relation of some contexts in documents.
It's used machine translation and text generation.
For example, DeepDazai can output novel like a Osamu Dazai.
It is very interesting.
LSTM can simulate long term memory and short term memory of humans.
And, It can grasp relation of some contexts in documents.
It's used machine translation and text generation.
For example, DeepDazai can output novel like a Osamu Dazai.
It is very interesting.
LSTM can simulate long term memory and short term memory of humans.
And, It can grasp relation of some contexts in documents.
It's used machine translation and text generation.
For example, DeepDazai can output novel like a Osamu Dazai.
It is very interesting.
Detail, I use two machine learning algorithms.
It’s called LSTM and Q-Learning.
LSTM can simulate long term memory and short term memory of humans.
And, It can grasp relation of some contexts in documents.
It's used machine translation and text generation.
For example, DeepDazai can output novel like a Osamu Dazai.
It is very interesting.
LSTM can simulate long term memory and short term memory of humans.
And, It can grasp relation of some contexts in documents.
It's used machine translation and text generation.
For example, DeepDazai can output novel like a Osamu Dazai.
It is very interesting.
LSTM can simulate long term memory and short term memory of humans.
And, It can grasp relation of some contexts in documents.
It's used machine translation and text generation.
For example, DeepDazai can output novel like a Osamu Dazai.
It is very interesting.
LSTM can simulate long term memory and short term memory of humans.
And, It can grasp relation of some contexts in documents.
It's used machine translation and text generation.
For example, DeepDazai can output novel like a Osamu Dazai.
It is very interesting.
LSTM can simulate long term memory and short term memory of humans.
And, It can grasp relation of some contexts in documents.
It's used machine translation and text generation.
For example, DeepDazai can output novel like a Osamu Dazai.
It is very interesting.
LSTM can simulate long term memory and short term memory of humans.
And, It can grasp relation of some contexts in documents.
It's used machine translation and text generation.
For example, DeepDazai can output novel like a Osamu Dazai.
It is very interesting.
LSTM can simulate long term memory and short term memory of humans.
And, It can grasp relation of some contexts in documents.
It's used machine translation and text generation.
For example, DeepDazai can output novel like a Osamu Dazai.
It is very interesting.
LSTM can simulate long term memory and short term memory of humans.
And, It can grasp relation of some contexts in documents.
It's used machine translation and text generation.
For example, DeepDazai can output novel like a Osamu Dazai.
It is very interesting.
LSTM can simulate long term memory and short term memory of humans.
And, It can grasp relation of some contexts in documents.
It's used machine translation and text generation.
For example, DeepDazai can output novel like a Osamu Dazai.
It is very interesting.
LSTM can simulate long term memory and short term memory of humans.
And, It can grasp relation of some contexts in documents.
It's used machine translation and text generation.
For example, DeepDazai can output novel like a Osamu Dazai.
It is very interesting.
LSTM can simulate long term memory and short term memory of humans.
And, It can grasp relation of some contexts in documents.
It's used machine translation and text generation.
For example, DeepDazai can output novel like a Osamu Dazai.
It is very interesting.
LSTM can simulate long term memory and short term memory of humans.
And, It can grasp relation of some contexts in documents.
It's used machine translation and text generation.
For example, DeepDazai can output novel like a Osamu Dazai.
It is very interesting.
LSTM can simulate long term memory and short term memory of humans.
And, It can grasp relation of some contexts in documents.
It's used machine translation and text generation.
For example, DeepDazai can output novel like a Osamu Dazai.
It is very interesting.