# XSShield: Defending Against Stored XSS Attacks Using LLM-Based Semantic Understanding
## 3 XSShield Design
### Data Adaptor
#### 3.2.1 PDG Generator
These detectors are widely used by relevant researchers [37]. We specifically selected these JavaScript malware detectors (Cujo, Zozzle, JStap) for comparison because, unlike traditional XSS defense mechanisms that require trusted server environments, these client-side detection methods can potentially function when server integrity is compromised. This aligns with our research goal of defending against stored XSS attacks in scenarios where server-side defenses \begin{table}
\begin{tabular}{c c c} \hline \hline  & **Development Set** & **Evaluation Set** \\ \hline \multirow{3}{*}{Malicious} & HynekPetrak/JavaScript-malware-collection & \multirow{3}{*}{BeEF Implement} \\  & geeksonsecurity/js-malicious-dataset & \\  & VirusTotal & \\ \hline Benign & JS150k (excluding low-redundancy samples) & 305 low-redundancy JS files \\ \hline \hline \end{tabular}
\end{table} 
Table 1: Dataset composition for evaluation. have been bypassed or disabled by attackers who have gained server access. When training these detectors, benign and malicious datasets were divided into train, validation, and test sets in proportions of 60%, 20%, and 20%, respectively, as development set, with models trained strictly according to each project's specified procedures. Cujo [38] decomposes source code into lexical tokens and efficiently extracts these tokens from JavaScript code through custom Yacc grammar. Feature extraction is completed using Q-gram techniques, followed by classification using Support Vector Machines. In this evaluation, we used [PERSON] et al. 's reimplementation [39] of Cujo's static detection component. Zozzle [40] extracts syntactic information from JavaScript's AST, performs feature selection through correlation methods, and then uses Bayesian classifiers for data classification. This study employed [PERSON] et al. 's reimplementation [41] of Zozzle. JStap [42] extracts representations from code, including lexical tokens, AST, and Control Flow Graphs (CFGs). Feature extraction employs N-Gram features and node value features, followed by classification using random forest classifiers. In this evaluation, we focused on its AST abstraction and PDG abstraction, utilizing n-gram and value feature-extraction patterns. We used the official implementation [43] available on GitHub. #### 4.2.2 Effectiveness Evaluation

**Performance of XSShield. ** To evaluate XSShield's effectiveness in detecting stored XSS attacks, we conducted performance testing on the evaluation set with GPT-3.5-turbo as the base model. In this binary classification task, besides detection accuracy, we also employed Matthews Correlation Coefficient (MCC) and F1 score as evaluation metrics. MCC provides a comprehensive evaluation of model performance, while the F1 score reflects the harmonic mean of precision and recall. An ideal attack detector should have high discrimination ability and classification accuracy, with MCC and F1 scores approaching 1. The dual-metric evaluation system using MCC and F1 scores enables both comprehensive objective assessment of classifier performance on positive and negative samples and examination of its ability to reduce false positives and improve detection rates in practical applications. _Results._ Table 2 presents a comprehensive performance comparison across XSShield and other detectors (columns), evaluating their detection capabilities on classified evaluation set (rows). XSShield demonstrates excellent performance across various attack scenarios. For non-obfuscated samples, the framework achieves 90.66% detection accuracy, an F1 score of 0.8991, and MCC of 0.8137, demonstrating powerful discrimination ability. In key attack categories, the framework performs particularly well: detection rates reach 93.75% for persistence and social engineering attacks, and 92.92% for vulnerability-based attacks. When facing obfuscated samples representing more complex attack variants, XSShield maintains stable performance: 72.46% detection rate, 0.7018 F1 score, and 0.5973 MCC.