# XSShield: Defending Against Stored XSS Attacks Using LLM-Based Semantic Understanding
## 3 XSShield Design
### Data Adaptor
#### 3.2.1 PDG Generator
Addressing this challenge, subsequent research made progress in multiple directions. [PERSON] et al. [53] revealed security challenges posed by fragile JavaScript code through in-depth study of client-side sandbox mechanisms. [PERSON] et al. [54] explored multi-execution techniques for discovering environment-dependent malware. [PERSON] et al. further advanced the combination of static and dynamic analysis methods through developing the JaSt [55] and JStap [42] systems. In recent years, machine learning methods have shown promising application prospects in this field. [PERSON] et al. [56] demonstrated the effectiveness of recurrent neural networks in analyzing JavaScript execution trajectories, while [PERSON] et al. [57] further applied deep learning methods to analyze AST features and paragraph vectors. However, it is worth noting that relying solely on code structure analysis to determine malicious intent has fundamental limitations, as attackers can carefully design payloads that appear legitimate but are actually malicious. ### Prompt Crafting

Research in prompt-learning techniques has made significant progress in the cybersecurity domain. [PERSON] et al. constructed a comprehensive framework integrating pre-trained language models and prompt learning. [PERSON] et al. [58] developed the AutoPrompt system, achieving automatic generation of task-specific prompts. [PERSON] et al. [59] expanded application scenarios by combining prompt learning with few-shot learning. [PERSON] and [PERSON] [60] enhanced model few-shot learning capabilities through pattern-exploitation training. In security applications, [PERSON] et al. [61] studied prefix-tuning techniques to better adapt LLMs to specific security tasks. [PERSON] et al. [62] demonstrated LLMs' advantages in code understanding using advanced prompt-engineering techniques, providing important support for security analysis. Additionally, [PERSON] et al. [63] proposed feature-extraction-enhancement schemes based on advanced prompt engineering, while [PERSON] et al. [64] integrated systems such as LangChain and GPT-3.5-turbo for automated vulnerability detection. Although existing research has achieved important results, the application potential of prompt learning in network security analysis remains to be further explored. ## 7 Conclusions

This paper presents XSShield, a novel client-side framework that detects and defends against stored XSS attacks through code intent recognition. The framework combines LLMs and PDGs for JavaScript code semantic analysis, breaking through limitations of traditional differential analysis methods. Experimental results demonstrate that XSShield shows significant advantages in stored XSS attack identification compared to existing solutions. The framework adopts a semi-automated learning mechanism, enabling continuous adaptation to new attack patterns, providing a robust and sustainable solution for long-term network security protection. These research findings are expected to help the community better address the increasingly severe threat of stored XSS vulnerabilities. Data curation, Y.Z. ([PERSON]) and W.Y. ; Formal analysis, Y.Z. ([PERSON]), W.G., S.Y., Y.Z. ([PERSON]) and W.Q. ; Investigation, Y.Z. ([PERSON]) and E.W. ; Methodology, Y.Z. ([PERSON]) and W.X. ; Resources, Y.Z. ([PERSON]); Software, Y.Z. ([PERSON]) and W.Y. ; Supervision, E.W. and W.X. ; Validation, Y.Z. ([PERSON]); Writing--original draft, Y.Z. ([PERSON]); Writing--review & editing, Y.Z. ([PERSON]) and E.W. All authors have read and agreed to the published version of the manuscript. This research received no external funding. Not applicable. The original contributions presented in this study are included in the article. Further inquiries can be directed to the corresponding author. The authors declare no conflicts of interest. ## Abbreviations

The following abbreviations are used in this manuscript: