# Detection of Reflected XSS Vulnerabilities Based on Paths-Attention Method
## 1 Introduction  
As the most common channel for internet users to interact with the internet, websites not only provide various services for users but also store their important assets and sensitive information. However, when a web attack occurs, it can cause huge losses to businesses and erode user trust [1]. With the increasing complexity of website requirements in recent years and varying technical skills among programmers, vulnerabilities are becoming more frequent. Among them, XSS vulnerabilities are commonly exploited by attackers to achieve illegal purposes. Since 2017, the frequency of XSS vulnerability has ranked seventh on the entire network and has climbed to third place as of 2021. Attacks caused by XSS vulnerabilities have high levels of harm and universality. In recent years, as Web2.0 applications gradually become mainstream compared to Web1.0, which is more static in nature, Web2.0 is more interactive in nature than its predecessor. Web statistics show that 68% of websites on the Internet have potential XSS vulnerabilities. Some well-known domestic and foreign companies such as Facebook, Twitter, Baidu, Sohn, etc., have experienced attacks due to XSS vulnerabilities causing incalculable economic losses.  
There are many types of XSS vulnerabilities, among which the reflective XSS vulnerability is more destructive and harder to prevent in advance. Reflective XSS (cross-site scripting) vulnerability is a common web application security vulnerability [2]. Attackerscan use this vulnerability to execute malicious scripts on the victim's browser, thereby stealing sensitive information or using the user's identity to perform malicious operations. The principle of this vulnerability is that attackers inject malicious scripts into the response of a web application by constructing special links, forms, or other input parameters. When users visit infected pages, the malicious script will be executed, achieving the attacker's goal. These injected scripts usually contain JavaScript code that can steal user cookies and data inputs, and even simulate user actions.  
To prevent such attacks, developers and security testers need to conduct reflective XSS vulnerability detection on web applications [3]. However, traditional defense techniques do not perform well in detecting XSS vulnerabilities. Traditional defense techniques can be divided into passive defense and active defense methods [4; 5]. Passive defense judges whether the server has been attacked by detecting the user's request payload, thus performing passive defense. However, facing constantly evolving attack techniques, passive defense technology is somewhat inadequate. Active defense finds injection points of websites through black box testing to determine if there are XSS vulnerabilities and fixes them for active prevention purposes [6]. However, on one hand, black box testing requires a lot of time and computation for analysis; on the other hand, even if injection points are found, they still need to be combined with white box testing for vulnerability positioning [7]. This makes this method no longer applicable to large-scale website source code.  
This article proposes a paths-attention-based model for detecting reflective-XSS- vulnerabilities that addresses issues related to low efficiency and poor accuracy associated with traditional methods used for detecting these types of flaws. The rest of the article is organized as follows: Section 2 introduces research results on this detection problem in recent years. In Section 3, we describe how to establish paths-attention methods for reflective-XSS-vulnerability detection. Section 4 presents simulation results and analysis of vulnerability detection experiments, while Section 5 provides a summary of the experiment. Finally, lists references used in this article.