# XSShield: Defending Against Stored XSS Attacks Using LLM-Based Semantic Understanding
## 3 XSShield Design
### Data Adaptor
#### 3.2.1 PDG Generator
Available online: [[https://owasp.org/www-community/attacks/xss/](https://owasp.org/www-community/attacks/xss/)]([https://owasp.org/www-community/attacks/xss/](https://owasp.org/www-community/attacks/xss/)) (accessed on 3 December 2024). * (2) HackerOne. 8 th Annual Hacker-Powered Security Report. 2024. Available online: [[https://hackerpoweredsecurityreport.com/](https://hackerpoweredsecurityreport.com/)]([https://hackerpoweredsecurityreport.com/](https://hackerpoweredsecurityreport.com/)) (accessed on 3 December 2024). * (3) Project, C. cvelistV5. 2023. Available online: [[https://github.com/CVEProject/cvelistV5/](https://github.com/CVEProject/cvelistV5/)]([https://github.com/CVEProject/cvelistV5/](https://github.com/CVEProject/cvelistV5/)) (accessed on 3 December 2024). * (4) Database, N.V. CVE-2023-40000. 2023. Available online: [[https://nvd.nist.gov/vuln/detail/CVE-2023-40000/](https://nvd.nist.gov/vuln/detail/CVE-2023-40000/)]([https://nvd.nist.gov/vuln/detail/CVE-2023-40000/](https://nvd.nist.gov/vuln/detail/CVE-2023-40000/)) (accessed on 3 December 2024). * (5) [PERSON]; [PERSON] Study and Design of Stored-XSS Vulnerability Detection. _Comput. Appl. Softw._**2013**, 17-21. * (6) [PERSON]; [PERSON]; [PERSON]; [PERSON]; [PERSON]; [PERSON] All your clouds are belong to us: Security analysis of cloud management interfaces. In Proceedings of the 3 rd ACM Workshop on Cloud Computing Security Workshop (CCSW '11), New York, NY, USA, 21 October 2011; pp. 3-14. [CrossRef]
* (7) [PERSON]; [PERSON] Cross-Site Scripting (XSS) attacks and defense mechanisms: Classification and state-of-the-art. _Int. J. Syst. Assur. Eng. Manag._**2017**, \(8\), 512-530. [CrossRef]
* (8) [PERSON]; [PERSON]; [PERSON] Robust defenses for cross-site request forgery. In Proceedings of the 15 th ACM Conference on Computer and Communications Security, Alexandria, VA, USA, 27-31 October 2008. [CrossRef]
* (9) [PERSON]; [PERSON]; [PERSON]; [PERSON]; [PERSON] Scriptless attacks: Stealing the pie without touching the sill. In Proceedings of the 2012 ACM Conference on Computer and Communications Security (CCS '12), New York, NY, USA, 16-18 October 2012; pp. 760-771. [CrossRef]
* (10) [PERSON]; [PERSON] XSS-SAFE: A Server-Side Approach to Detect and Mitigate Cross-Site Scripting (XSS) Attacks in JavaScript Code. _Arab. J. Sci. Eng._**2015**, _41_, 897-920. [CrossRef]
* (11) [PERSON] Can Large Language Models Find and Fix Vulnerable Software? _arXiv_**2023**, arXiv:2308.10345. * (12) [PERSON]; [PERSON]; [PERSON]; [PERSON]; [PERSON] From ChatGPT to ThreatGPT: Impact of Generative AI in Cybersecurity and Privacy. _IEEE Access_**2023**, _11_, 80218-80245. [CrossRef]
* (13) [PERSON]; [PERSON]; [PERSON] [PERSON]; [PERSON]; [PERSON] [PERSON]; [PERSON] [PERSON]; [PERSON]; [PERSON] [PERSON]; [PERSON]; [PERSON]; et al. Red Teaming Language Models to Reduce Harms: Methods, Scaling Behaviors, and Lessons Learned. _arXiv_**2022**, arXiv:2209.07858. * (14) [PERSON]; [PERSON]; [PERSON]; [PERSON]; [PERSON]; [PERSON]; [PERSON] Security foundation of deep learning: Formalization, verification, and applications. _ACM Comput. Surv._**2022**, _55_, 1-35. [CrossRef]
* (15) [PERSON]; [PERSON]; [PERSON]; [PERSON]; [PERSON] 12 Angry Developers--A Qualitative Study on Developers' Struggles with CSP. In Proceedings of the 2021 ACM SIGSAC Conference on Computer and Communications Security (CCS '21), New York, NY, USA, 15-19 November 2021; pp. 3085-3103. [CrossRef]
* (16) [PERSON]; [PERSON]; [PERSON]; [PERSON]; [PERSON]; [PERSON]; [PERSON] JSCSP: A Novel Policy-Based XSS Defense Mechanism for Browsers. _IEEE Trans. Dependable Secur. Comput._**2022**, _19_, 862-878. [CrossRef]
* (17) [PERSON]; [PERSON]; [PERSON]; [PERSON]; [PERSON]; [PERSON] CSPAutoGen: Black-box Enforcement of Content Security Policy upon Real-world Websites. In Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security (CCS '16), New York, NY, USA, 24-28 October 2016; pp. 653-665. [CrossRef]
* (18) [PERSON]; [PERSON] Sandboxing Adoption in Open Source Ecosystems.