# Detection of Reflected XSS Vulnerabilities Based on Paths-Attention Method
## 5 Conclusions  
This article proposes a detection method for reflected XSS vulnerabilities based on paths-attention. This method extracts semantic information and syntax features from the code to obtain the vector representation of the code, which is then used for detecting reflected XSS vulnerabilities. Firstly, by analyzing the principle of reflected XSS vulnerabilities and relevant research, it is found that semantic extraction methods can be utilized. Secondly, considering the inefficiency and unclear results caused by using a single semantic extraction model, an attention mechanism is introduced in the construction structure of the model theory. The original data are transformed into input variables and processed through fully connected layers, and then detailed explanations are given on what attention mechanism is, why it should be introduced, and how to introduce it. After combining semantic extraction methods with attention mechanisms and training with datasets, the PATS (paths-attention-based detection method) model is obtained. The main contribution of this paper lies in proposing the PATS model when there is no effective solution for reflected XSS vulnerabilities currently available. It has been proven that PATS significantly improves  
Figure 12: Comparison of ablation results.  
detection accuracy and exhibits excellent performance. In experiments comparing PATs with other semantic extraction models in terms of feature extraction, both accuracy rate and F-1 score show an improvement of over 50%. Furthermore, experiments using the PATS model compared with other related models for XSS vulnerability detection demonstrate that even under significant speed conditions, it still achieves an accuracy rate above 90%. Utilizing a combination of semantic extraction and attention mechanism methods in PATS outperforms traditional vulnerability detection models. In practical applications, real-time monitoring can be achieved by installing detection software based on the PATS model while calling user traffic databases for detection purposes, since each piece of data undergoes code transformation and the semantic extraction process, effectively avoiding privacy-related issues as well as other concerns. However, the current combination of semantic extraction methods with attention mechanisms only focuses on testing existing datasets related to reflected XSS vulnerabilities; it does not achieve significant performance improvement for other types of vulnerabilities, such as DOM-based vulnerabilities. In the future, efforts will be made to achieve good detection results for more types of XSS vulnerabilities by increasing computational power models and making appropriate adjustments to the structure.  
Conceptualization, Y.X. and X.T.; methodology, Y.X.; software, T.W.; validation, B.L., T.W. and X.T.; formal analysis, Y.X.; investigation, B.L.; resources, X.T.; data curation, T.W.; writing--original draft preparation, Y.X.; writing--review and editing, T.W. and X.T.; visualization, T.W.; supervision, B.L. and Y.X.; project administration, X.T.; funding acquisition, X.T. All authors have read and agreed to the published version of the manuscript.  
This research was funded by basic scientific research project of Liaoning Provincial Department of Education, (NO. LJKZ0241). Data Availability Statement: Data source has been declared at the dataset construction stage.  
We thank those anonymous reviewers whose comments/suggestions helped improve and clarify this manuscript.  
The authors declare no conflict of interest.