# Detection of Reflected XSS Vulnerabilities Based on Paths-Attention Method
## 4 Experimental Design and Analysis
### Analysis of XSS Vulnerability Detection Results  
Currently, traditional model methods do not have good detection capabilities for XSS vulnerabilities. Through the research of other scholars, it is known that N-gram [23], Tree-LSTM [24], and Siamese network [25] are three models that are relatively good at detecting XSS vulnerabilities in terms of comprehensive ability. Therefore, they were set as control groups in this experiment. However, these three models did not specifically address reflected XSS vulnerabilities during construction. The three models N-gram, Tree-LSTM, and Siamese network were not specifically designed to address reflected XSS vulnerabilities during their construction. To compare them better and objectively with the PATS model proposed in this paper, adjustments were made based on the source code provided by the model authors so that they could detect reflected XSS vulnerabilities. However, this also reflects another advantage of vulnerability detection models based on code semantics: they are not constrained by programming languages. In the final experiment, the experimental parameters from Section 4.3 were used, and a test dataset consisting of 25% of the total dataset was utilized for detection experiments. The following indicator values were obtained: accuracy (ACC), true positive rate (TPR), false positive rate (FPR), and F-1 score, which is a comprehensive evaluation of precision and recall used to balance the model. The comparison results of the models are shown in Table 3.  
As concluded in the previous theoretical analysis section, the accuracy of the PATS model can reach 90.25%, while the tree-structured LSTM is 83.02% and has a recall rate of 74.52%. From the results, compared to other models, the PATS model has an advantage. In addition to these evaluation criteria, the detection speed of these models was also compared. The comparison of model detection speeds is shown in Table 4.  
It is worth noting that the training time in the table excludes the time for data representation conversion during processing, and only counts the time consumed by model training and testing for one iteration. Nevertheless, the PATS model still demonstrates significant advantages over other models in terms of comprehensive detection time and accuracy. \begin{table}
\begin{tabular}{c c c c c} \hline \hline
**Model** & **ACC** & **TRP** & **FPR** & **F-1** \\ \hline N-gram & 0.6154 & 0.1085 & 0.0427 & 0.1844 \\ Tree-LSTM & 0.8302 & 0.5896 & 0.0690 & 0.6993 \\ Siamese Network & 0.8117 & 0.6528 & 0.0613 & 0.7237 \\ Paths-Attention (this model) & 0.9025 & 0.7451 & 0.0836 & 0.8162 \\ \hline \hline \end{tabular}
\end{table} 
Table 3: Evaluation of test results. Figure 9: Effect of training time and F-1 score. During the experiment, we compared the impact of different convolutional layers on model detection results, selected one to five fully connected layers, and compared direct connection with residual connection. The results are shown in Figure 10.  
It can be seen intuitively that when the number of directly connected layers is greater than two, the accuracy begins to decline, while the residual connection starts to decline when it exceeds three. We compared the training and detection time of models with one-layer direct connection and three-layer residual connection, as shown in Figure 11.  
From the figure, the training time of the model with three layers of residual connections is much longer than that of the model with one layer of direct connections. Reflected XSS vulnerability detection requires high timeliness, and zero-day vulnerabilities are the most harmful period for a vulnerability, so it is important to fix them before they are exploited. Zero-day vulnerabilities refer to security vulnerabilities that are immediately exploited once discovered. With advances in attack techniques, vulnerabilities that used to take