# Detection of Reflected XSS Vulnerabilities Based on Paths-Attention Method
## 3 Vulnerability Detection Method Based on Paths-Attention
### Theoretical Analysis of Paths-Attention Vulnerability Detection Method
#### 3.1.2 Semantic Extraction and Vulnerability Detection Compatibility Analysis of Paths-Attention  
At present, there has been a research approach to vulnerability detection from the perspective of source code. However, most of the source-code-based detections remain at the level of similarity, keywords, or self-learning features. Here are also listed some representative detection methods. Tree-LSTM: [PERSON], [PERSON], [PERSON], and others proposed an automatic feature learning method for predicting vulnerable software components [20]. This model takes Java source files as granularity, where each source file consists of imported Jar packages and a set of function methods. It uses tree-structured LSTM to extract features from each method and represent them with vectors. Then it uses pooling layers to output local features of the entire file. To handle cross-project situations, the authors cluster all tokens of the entire project's files using k-means to form a codebook table with multiple token states/categories, generating global features based on this table. Finally, it combines global and local features and uses classifiers for vulnerability classification detection. The detection process of the whole model is shown in Figure 2.  
From the figure, this model learns the source code files through an LSTM network. The output of the model is then fed into a pooling layer to obtain an aggregated feature vector. At the same time, bag-of-token states are used to generate global features for the entire file. After aggregating local and global features, the model uses them for vulnerability detection. The difference between paths-attention and the above methods lies in the granularity of the source code data used, which is based on function-level rather than file-level. Firstly, most vulnerability features in source code only exist in a few lines of code, and using files as the granularity range is too large, making it easy to drown out vulnerability features in the entire feature vector. In addition, this model focuses on automatic feature learning, which undoubtedly greatly increases the system's computational complexity and reduces its vulnerability detection efficiency. To avoid these drawbacks, paths-attention has made the following optimizations. * By using a function-based approach, the system reduces the learning cost for vulnerability features. * The introduction of attention mechanism enables the model to extract semantic information more effectively, and the detection efficiency is higher when finding vulnerability features in semantic features. Code similarity: In [PERSON]'s vulnerability detection method based on code similarity, it is mentioned that most of the current research on using code similarity to detect vulnerabilities is based on the similarity of syntax structure and semantic features of the code. However, the biggest drawback of such methods is that they cannot distinguish between code fragments with similar semantics. Sometimes, even if the semantics are very similar, slight differences can lead to one having a vulnerability while another does not. To address this issue, [PERSON] proposed using a Siamese network combined with a bidirectional LSTM network and introduced an attention mechanism based on this foundation. The entire model processing process is shown in Figure 3.  
Figure 3: Siamese network detection model process. Figure 2: The detection model process of tree LSTM. From the figure, the author introduced common vulnerabilities and exposures (CVE), which specifies that two identical vulnerabilities in different versions should be considered similar; conversely, if a vulnerability is eliminated by patch code, the vulnerability and patch code should be considered different. This method avoids the drawbacks of similar semantic code fragments. Due to the strict selection criteria mentioned above for CVEs, the sample size is relatively small. Therefore, the author used metric learning to conduct training.