# XSShield: Defending Against Stored XSS Attacks Using LLM-Based Semantic Understanding
## 3 XSShield Design
### Data Adaptor
#### 3.2.1 PDG Generator
This approach ensures direct compatibility with LLM processing mechanisms while retaining the program's core semantics, simultaneously avoiding redundant factors that might affect analysis through systematic pruning of non-essential code constructs. Following minimalist design principles, the generator preserves only necessary constructs required for capturing behavioral patterns, including control flow statements, data dependencies, and critical API calls, while eliminating redundant expressions and non-essential variables. The generator's effectiveness is further validated through comparative analysis with alternative representation methods, demonstrating superior performance in behavioral pattern retention and LLM compatibility. ### LLM-Based Detector

The framework adopts a pre-trained LLM (e.g., GPT-3.5-turbo) as the base model without additional fine-tuning. This design choice leverages the model's inherent code-comprehension capability while avoiding the computational overhead of model retraining. The detection capability is achieved through our innovative prompt optimization rather than model parameter updates. Based on the extraction and processing of multiple candidate code segments from the target code described in Section 3.2, we constructed a pre-trained LLM-based detection framework. This framework operates using prompts that have undergone comprehensive training optimization as detailed in Section 3.1. Our prompt-engineering approach integrates both semantic precision and structural optimization dimensions to enhance model-understanding capabilities for specific tasks. **Structured Output. ** To achieve reliable binary classification, we designed an output-control mechanism. This mechanism enforces model responses to begin with \"yes\" or \"no\" by adding a format requirement to the base prompt. Specifically, the instruction \"answer with 'yes' or 'no\" is appended to the original prompt. This design not only improves classification accuracy but also eliminates output ambiguity. The output-control mechanism is formally expressed as:

\[Prompt_{final}=Prompt_{original}+\text{``answer with 'yes' or 'no''} \tag{6}\]where \(Prompt_{original}\) is the initial training prompt, and the additional instruction ensures that the model's response starts with \"yes\" or \"no\". \(Prompt_{final}\) is the complete prompt sequence used for model queries. This structured approach ensures consistency and accuracy in LLM outputs, enabling the framework to reliably identify potential attack vectors in code segments while maintaining high detection accuracy. ## 4 Experiment

### Implementation

Evaluation Set.This research implemented the XSShield framework as a browser extension, drawing upon relevant code from previous research [30]. The extension is designed to intercept JavaScript payloads during webpage rendering through strategic hook injection into XMLHttpRequest and fetch API, enabling comprehensive monitoring of both static and dynamically loaded script content. The evaluation methodology employed a target drone containing stored XSS vulnerabilities, tested against 610 diverse XSS attack samples. This dataset comprised 305 attacks derived from the BeEF repository [31], carefully selected to encompass all attack modules categorized within the framework. For example, Listing 1 shows a typical stored XSS attack fragment that detects ActiveX components in a victim's browser and reports the findings back to the attacker's server. ```
1 varresult=(beef.browser.hasActiveX())?Yes=:\"No\";
2 beef.net.send(\"/command/detect_activex.js\",1486,\"activex=\"+result);
```

Listing 1: A code fragment demonstrating ActiveX component detection via stored cross-site scripting vulnerability. Additionally, 305 obfuscated attack variants were generated by applying the JavaScript-Obfuscator tool [32] with default configuration settings to the original BeEF samples. This configuration implemented multiple obfuscation techniques, including variable renaming, string array transformation, and string array rotation and shuffling.