# XSShield: Defending Against Stored XSS Attacks Using LLM-Based Semantic Understanding
## 3 XSShield Design
### Data Adaptor
#### 3.2.1 PDG Generator
Available online: [[https://github.com/geeksonsecurity/js-malicious-dataset](https://github.com/geeksonsecurity/js-malicious-dataset)]([https://github.com/geeksonsecurity/js-malicious-dataset](https://github.com/geeksonsecurity/js-malicious-dataset)) (accessed on 10 March 2025). * (37) [PERSON]; [PERSON]; [PERSON]; [PERSON] Wobfuscator: Obfuscating JavaScript Malware via Opportunistic Translation to WebAssembly. In Proceedings of the 2022 IEEE Symposium on Security and Privacy (SP), San Francisco, CA, USA, 22-26 May 2022; pp. 1574-1589. [CrossRef]
* (38) [PERSON]; [PERSON]; [PERSON] CUJO: Efficient detection and prevention of drive-by-download attacks. In Proceedings of the 26 th Annual Computer Security Applications Conference, Austin, TX, USA, 6-10 December 2010; pp. 31-39. * (39) Aurore54F. lexical-jsdetector. 2024. Available online: [[https://github.com/Aurore54F/lexical-jsdetector](https://github.com/Aurore54F/lexical-jsdetector)]([https://github.com/Aurore54F/lexical-jsdetector](https://github.com/Aurore54F/lexical-jsdetector)) (accessed on 10 March 2025). * (40) [PERSON]; [PERSON]; [PERSON]; [PERSON] ZOZZLE: Fast and Precise In-Browser JavaScript Malware Detection. In Proceedings of the USENIX Security Symposium, USENIX Security Symposium, San Francisco, CA, USA, 10-12 August 2011. * (41) Aurore54F. syntactic-jsdetector. 2024. Available online: [[https://github.com/Aurore54F/syntactic-jsdetector](https://github.com/Aurore54F/syntactic-jsdetector)]([https://github.com/Aurore54F/syntactic-jsdetector](https://github.com/Aurore54F/syntactic-jsdetector)) (accessed on 10 March 2025). * (42) [PERSON]; [PERSON]; [PERSON] JStap: A Static Pre-Filter for Malicious JavaScript Detection. In Proceedings of the 35 th Annual Computer Security Applications Conference, San Juan, Puerto Rico, 9-13 December 2019; pp. 257-269. * (43) Aurore54F. JStap. 2024. Available online: [[https://github.com/Aurore54F/JStap](https://github.com/Aurore54F/JStap)]([https://github.com/Aurore54F/JStap](https://github.com/Aurore54F/JStap)) (accessed on 10 March 2025). * (44) [PERSON] [PERSON]; [PERSON] [PERSON]; [PERSON] Autonomous Cybersecurity: Evolving Challenges, Emerging Opportunities, and Future Research Trajectories. In Proceedings of the Workshop on Autonomous Cybersecurity (AutonomousCyber '24), New York, NY, USA, 14-18 October 2024; pp. 1-10. [CrossRef]
* (45) [PERSON]; [PERSON] [PERSON]; [PERSON]; [PERSON]; [PERSON] A Robust Privacy-Preserving Federated Learning Model Against Model Poisoning Attacks. _IEEE Trans. Inf. Forensics Secur._**2024**, _19_, 6693-6708. [CrossRef]
* (46) [PERSON]; [PERSON]; [PERSON] Defeating script injection attacks with browser-enforced embedded policies. In Proceedings of the 16 th International Conference on World Wide Web (WWW '07), New York, NY, USA, 8-12 May 2007; pp. 601-610. [CrossRef]
* (47) [PERSON]; [PERSON] Noncespaces: Using Randomization to Enforce Information Flow Tracking and Thwart Cross-Site Scripting Attacks. In Proceedings of the Network and Distributed System Security Symposium, San Diego, CA, USA, 8-11 February 2009. * (48) [PERSON]; [PERSON]; [PERSON]; [PERSON]; [PERSON] Precise client-side protection against DOM-based cross-site scripting. In Proceedings of the 23 rd USENIX Conference on Security Symposium (SEC'14), Anaheim, CA, USA, 9-11 August 2014; pp. 655-670. * (49) [PERSON]; [PERSON]; [PERSON] Context-sensitive auto-sanitization in web templating languages using type qualifiers. In Proceedings of the 18 th ACM Conference on Computer and Communications Security, New York, NY, USA, 17-21 October 2011; pp. 587-600. [CrossRef]
* (50) [PERSON]; [PERSON]; [PERSON]; [PERSON]; [PERSON]; [PERSON] A Systematic Analysis of XSS Sanitization in Web Application Frameworks. In _Computer Security--ESORICS 2011_; [PERSON], [PERSON]; Springer: Berlin/Heidelberg, Germany, 2011; pp. 150-171. * (51) [PERSON]; [PERSON]; [PERSON]; [PERSON]; [PERSON] Riding out DOMsday: Towards Detecting and Preventing DOM Cross-Site Scripting.