# XSShield: Defending Against Stored XSS Attacks Using LLM-Based Semantic Understanding
## 1 Introduction  
Cross-site scripting (XSS) attacks represent one of the primary security threats facing web applications today. As an authoritative reference for web security, the OWASP Top 10 [1] has reflected the industry's broad consensus on web application security risks since 2003, with XSS attacks consistently ranking in the top ten. In the latest 2021 edition, XSS attacks ranked third (as a major type of injection vulnerability), demonstrating their continued impact on web security. Furthermore, HackerOne's Hacker-Powered Security Report [2] indicates that XSS vulnerabilities have consistently ranked first among the top ten vulnerabilities disclosed in bug bounty programs for several consecutive years. Common XSS attacks are primarily categorized into reflected and stored types. In recent years, stored XSS attacks have emerged as the predominant form of XSS attacks, with both their severity and frequency steadily increasing. According to statistics from the official CVE list [3], among the 28,000 vulnerabilities disclosed in 2023, XSS vulnerabilities accounted for 13.2%, with stored XSS attacks comprising 59.5% of these cases, involving over 2200 incidents. A notable example is the stored XSS vulnerability (CVE-2023-40000) [4] discovered in WordPress's LiteSpeed Cache plugin, which allowed unauthenticated attackers to inject malicious code across entire websites, affecting millions of WordPress sites and demonstrating the widespread impact of stored XSS attacks. The threat of stored XSS attacks further intensified in the first half of 2024, with stored XSS attacks accounting for 15.1% of the 8600 disclosed CVE vulnerabilities, involving over 1300 cases. The escalating severity of stored XSS attacks can be attributed primarily to their paradigmatic difference from reflected XSS attacks and the long-standing absence of effective defense techniques. While mainstream browsers can identify and block reflected XSS attacks through differential analysis of HTTP requests and responses where injection and execution occur within the same user's browser, stored XSS attacks present unique challenges due to their temporal and spatial asynchrony between injection and execution phases. In stored XSS attacks, malicious code is typically pre-injected by attackers into server-side systems (such as databases, file systems, or caches) and remains dormant until triggered by users across different sessions and extended time intervals. This temporal and spatial decoupling renders traditional browser-based defense mechanisms ineffective [5], as they struggle to establish correlations between the payload about to be executed and its original injection path, making detection methods based on request-response differential analysis inadequate for addressing stored XSS vulnerabilities. Specifically, effectively defending against stored XSS attacks faces two key challenges: (1) Difficulty in attack vector localization and identification: Stored XSS malicious code persists on the server side, making traditional differential analysis ineffective in correlating injection and execution paths. Additionally, attackers may employ code obfuscation and camouflage techniques to hide attack code, increasing the difficulty of detection through pattern-matching methods. (2) High requirements for real-time and fine-grained defense systems: In practical application scenarios, attackers often embed malicious code within large amounts of normal code, requiring defense systems to not only quickly identify malicious code to avoid increasing webpage loading delays in users' browsers but also precisely locate attack code segments to prevent disabling normal webpage functionality over too broad a range. Therefore, defense systems must simultaneously meet high efficiency and high precision requirements.