# XSShield: Defending Against Stored XSS Attacks Using LLM-Based Semantic Understanding
## 3 XSShield Design
### Data Adaptor
#### 3.2.1 PDG Generator
Analysis reveals that when facing original attack implementations, all comparison group detectors performed poorly, generally misclassifying both attack and non-attack samples as benign. When processing obfuscated attacks, Cujo showed no response, while other detectors displayed limited reaction. JStap's four variants performed inadequately; although F1 scores showed slight improvement (maximum reaching only 0.1354), considering the significant decrease in MCC (minimum of \(-\)0.1900), this improvement likely stems from obfuscation-induced bias. Zozzle performed better on obfuscated attack samples (F1 score of 0.5983) but completely failed on obfuscated non-attack samples (0% accuracy), misclassifying many obfuscated benign samples as malicious, indicating the framework's over-reliance on obfuscation features as malicious indicators. In contrast, XSShield was the only framework maintaining reliable detection capability across both obfuscated and non-obfuscated datasets, although its recognition rate for obfuscated samples (64.92%) still has room for improvement. This performance nevertheless demonstrates XSShield's ability to effectively identify attack samples while maintaining accurate judgment of benign samples--a capability that becomes even more significant when considering false positive management. This comparison reveals a critical distinction: While JStap(astvalue) achieves 97.70% benign accuracy on obfuscated samples, it fails to detect 50.98% of actual attacks, reflecting a classic precision-recall tradeoff. XSShield, by contrast, strikes a superior balance--its 80% obfuscated benign accuracy (vs. Zozzle's catastrophic 0%) combined with 72.46% attack detection rate demonstrates practical viability in real-world deployment scenarios where both metrics are crucial. These findings align with the broader research consensus showing that structure-based malware detectors generally fail to identify actual deployed attacks, tending to misclassify them as benign samples. Within this context, XSShield demonstrates stable and reliable performance across various test scenarios, maintaining relatively high detection accuracy \begin{table}
\begin{tabular}{c c c c c c c} \hline
**Technique** & **Cujo** & **Zozzle** & **JStap (Pdagrams)** & **JStap (Pdagvalues)** & **JStap (Astngram)** & **JStap (Astvalue)** \\ \hline Benign & 0.99 (39,731 /39,731 + 18) & 39,153/39,153 + 143 & 34,816/34,816 & 34,760/34,760 + 2 & 38,676/38,676 + 1 & 38,687/38,687 + 2 \\ Malicious & 0.85 (4455/4455 + 769) & 0.82 (389/389 + 833) & 4462/4462 + 96 & 4417/4417 + 141 & 4885/4585 + 84 & 4541/4541 + 128 \\ \hline \end{tabular}
\end{table} 
Table 3: Detection accuracy of other detectors on test sets. and low false positive rates for both original and obfuscated attacks--a dual capability that existing detectors struggle to achieve simultaneously. #### 4.2.3 Ablation Experiment

**Effectiveness of the Prompt Optimizer. ** To evaluate the effectiveness of the XSShield Prompt Optimizer module, we designed a comparative experiment testing three different prompt-selection algorithms: Non-selector: using fixed handcrafted prompts without optimization; UCB: standard Upper Confidence Bound bandits prompt selection algorithm; and UCB-R: our improved Upper Confidence Bound bandits with weighted randomization prompt-optimization algorithm. _Results._ Figure 3 shows the F1 score trajectory during training. UCB-R demonstrates significant performance improvement, attributed to the introduction of randomness factors. Table 4 shows XSShield's detection accuracy under three configurations. Our improved UCB-R algorithm achieves 71.97% overall accuracy, demonstrating improvements of 13.61 percentage points over the baseline (58.36%) and 12.30 percentage points over the standard UCB (59.67%). The enhancement is particularly notable in malicious sample identification, where UCB-R achieves a 24.92 percentage point improvement in detection accuracy (from 43.28% to 68.20%) compared to the baseline.