# XSShield: Defending Against Stored XSS Attacks Using LLM-Based Semantic Understanding
## 1 Introduction
To address the first challenge, we propose XSShield, a novel client-side detection framework designed to leverage Large Language Models (LLMs) for in-depth semantic analysis of code received by browsers from servers to determine whether it contains potential malicious payloads. Compared to traditional detection methods, XSShield's uniqueness lies in its ability to achieve detection without relying on differential analysis by deeply understanding code behavior logic and semantic intent, thus overcoming the constraints of \"temporal-spatial decoupling\". Furthermore, this approach better handles obfuscated and disguised attack techniques, enhancing detection robustness and flexibility, effectively addressing the limitations of traditional methods when facing complex attack vectors. To address the second challenge, we designed and implemented two core components of XSShield: (1) Prompt Optimizer, which dynamically learns and selects optimal prompts based on semantic gradient descent and Upper Confidence Bound Bandits with Weighted Randomization (UCB-R) selection algorithms, enabling accurate distinction between malicious and normal code using general pre-trained models, featuring lightweight and easy deployment characteristics while significantly improving detection accuracy without notably increasing time costs. (2) Data Adaptor, which utilizes program dependence graphs (PDGs) and PDG subgraph-partitioning techniques to parse complex JavaScript programs into logically independent code segments while preserving key semantics closely related to control flow. This process ensures framework real-time performance and logical integrity during code analysis, achieving efficient deconstruction of complex code structures. Through fine-grained modeling of program dependencies, the Data Adaptor enables, in the framework, more precise identification and processing of code segments containing malicious payloads. Experimental results demonstrate XSShield's exceptional detection accuracy and efficiency. Using GPT-4 as the intelligence foundation, it achieves 93% accuracy and an F1 score of 0.9266 in detecting non-obfuscated attack samples, showing an average 88.8%improvement in accuracy compared to existing malicious code detectors such as Cujo, Zozzle, and JStap (as existing detectors generally struggle to detect stored XSS attacks). Even when facing obfuscated attack samples, XSShield maintains a 64.92% detection rate and a 0.7018 F1 score. Additionally, in terms of performance, XSShield's average processing time per file is only 0.205 s (excluding model communication overhead), comparable to other detectors' processing times, demonstrating no significant impact on user experience and proving the framework's practical deployability. In summary, the main contributions of this work include:
* **New framework. ** We propose XSShield, the first detection framework leveraging LLMs' code semantic understanding capabilities to defend against stored XSS attacks. This framework transcends traditional detection paradigms based on differential analysis and regular expression matching by deeply understanding JavaScript code's behavioral patterns and semantic intentions, pioneering new approaches to defending against stored XSS attacks. * **Lightweight, effective and efficient approach. ** We designed a Prompt Optimizer based on semantic gradient descent and UCB-R selection algorithms, along with a Data Adaptor based on PDGs, achieving code processing that balances real-time performance with fine granularity. Experimental evaluation of XSShield shows that when facing non-obfuscated stored XSS attacks, XSShield achieves an F1 score of 0.9266 on the GPT-4 model, significantly outperforming existing solutions with an average accuracy improvement of 88.8%. XSShield's average processing time in test data is 0.205 s (excluding model communication overhead), maintaining detection precision while keeping time overhead within a range that does not affect user experience, demonstrating practical deployability. * **Novel insights.