  The development and analysis of mobile applications in term of security have
become an active research area from many years as many apps are vulnerable to
different attacks. Especially the concept of hybrid applications has emerged in
the last three years where applications are developed in both native and web
languages because the use of web languages raises certain security risks in
hybrid mobile applications as it creates possible channels where malicious code
can be injected inside the application. WebView is an important component in
hybrid mobile applications which used to implements a sandbox mechanism to
protect the local resources of smartphone devices from un-authorized access of
JavaScript. However, the WebView application program interfaces (APIs) also
have security issues. For example, an attacker can attack the hybrid
application via JavaScript code by bypassing the sandbox security through
accessing the public methods of the applications. Cross-site scripting (XSS) is
one of the most popular malicious code injection technique for accessing the
public methods of the application through JavaScript. This research proposes a
framework for detection and prevention of XSS attacks in hybrid applications
using state-of-the-art machine learning (ML) algorithms. The detection of the
attacks have been perform by exploiting the registered Java object features.
The dataset and the sample hybrid applications have been developed using the
android studio. Then the widely used toolkit, RapidMiner, has been used for
empirical analysis. The results reveal that the ensemble based Random Forest
algorithm outperforms other algorithms and achieves both the accuracy and
F-measures as high as of 99%.
