# XSShield: Defending Against Stored XSS Attacks Using LLM-Based Semantic Understanding
## 3 XSShield Design
### Data Adaptor
#### 3.2.1 PDG Generator
In Proceedings of the Network and Distributed System Security Symposium, San Diego, CA, USA, 18-21 February 2018. * (52) [PERSON]; [PERSON] Content Security Policy Level 2. 2016. Available online: [[https[PERSON]www.w3.org/TR/CSP2/](https[PERSON]www.w3.org/TR/CSP2/)]([https[PERSON]www.w3.org/TR/CSP2/](https://www.w3.org/TR/CSP2/)) (accessed on 9 March 2025). * _[PERSON] et al. (2012)_ [PERSON]; [PERSON]; [PERSON]; [PERSON]; [PERSON]; [PERSON]: Complete client-side sandboxing of third-party JavaScript without browser modifications. In Proceedings of the Asia-Pacific Computer Systems Architecture Conference, Matsue, Japan, 28-31 August 2012. * _[PERSON] et al. (2012)_ [PERSON]; [PERSON] [PERSON]; [PERSON]; [PERSON]: De-cloaking Internet Malware. In Proceedings of the 2012 IEEE Symposium on Security and Privacy, San Francisco, CA, USA, 20-23 May 2012; pp. 443-457. [CrossRef]
* _[PERSON] et al. (2018)_ [PERSON]; [PERSON]; [PERSON]; [PERSON]: Fully Syntactic Detection of Malicious (Obfuscated) JavaScript. In _Detection of Intrusions and Malware, and Vulnerability Assessment_; [PERSON], [PERSON] [PERSON]; Springer: Cham, Switzerland, 2018; pp. 303-325. * _[PERSON] et al. (2016)_ [PERSON]; [PERSON]; [PERSON]. A deep learning approach for detecting malicious JavaScript code. _Sec. Commun. Netw._**2016**, \(9\), 1520-1534. [CrossRef]
* _[PERSON] et al. (2019)_ [PERSON]; [PERSON]; [PERSON] [PERSON]; [PERSON]; [PERSON] A machine learning approach to detection of JavaScript-based attacks using AST features and paragraph vectors. _Appl. Soft Comput._**2019**, _84_, 105721. [CrossRef]
* _[PERSON] et al. (2020)_ [PERSON]; [PERSON]; [PERSON]; [PERSON]; [PERSON] AutoPrompt: Eliciting Knowledge from Language Models with Automatically Generated Prompts. _arXiv_**2020**, arXiv:2010.15980. * _[PERSON] et al. (2021)_ [PERSON]; [PERSON]; [PERSON] Making Pre-trained Language Models Better Few-shot Learners. _arXiv_**2021**, arXiv:2012.15723. * _[PERSON] and [PERSON] (2021)_ [PERSON]; [PERSON] Exploiting Cloze Questions for Few Shot Text Classification and Natural Language Inference. _arXiv_**2021**, arXiv:2001.07676. * _[PERSON] et al. (2020)_ [PERSON]; [PERSON] Prefix-Tuning: Optimizing Continuous Prompts for Generation. _arXiv_**2021**, arXiv:2101.00190. * _[PERSON] et al. (2020)_ [PERSON]; [PERSON]; [PERSON]; [PERSON]; [PERSON]; [PERSON]; [PERSON]; [PERSON]; [PERSON]; [PERSON]; et al. Language Models are Few-Shot Learners. _arXiv_**2020**, arXiv:2005.14165. * _[PERSON] et al. (2023)_ [PERSON]; [PERSON]; [PERSON]; [PERSON]; [PERSON]; [PERSON] Cheap-Fake Detection with LLM Using Prompt Engineering. In Proceedings of the 2023 IEEE International Conference on Multimedia and Expo Workshops (ICMEW), Brisbane, Australia, 10-14 July 2023; pp. 105-109. [CrossRef]
* _[PERSON] et al. (2024)_ [PERSON]; [PERSON]; [PERSON]; [PERSON]; [PERSON]; [PERSON]; [PERSON]; [PERSON]; [PERSON] Where URLs Become Weapons: Automated Discovery of SSRF Vulnerabilities in Web Applications. In Proceedings of the 2024 IEEE Symposium on Security and Privacy (SP), San Francisco, CA, USA, 19-23 May 2024; pp. 239-257. [CrossRef]

**Disclaimer/Publisher's Note:** The statements, opinions and data contained in all publications are solely those of the individual author(s) and contributor(s) and not of MDPI and/or the editor(s). MDPI and/or the editor(s) disclaim responsibility for any injury to people or property resulting from any ideas, methods, instructions or products referred to in the content.