# Detection of Reflected XSS Vulnerabilities Based on Paths-Attention Method
## 3 Vulnerability Detection Method Based on Paths-Attention
### The Composition of the Paths-Attention Vulnerability Detection Method
#### 3.2.2 Code Mapping  
In this paper, the feature function \(\mathrm{Rep}\) is used to convert code snippets into mathematical objects for learning models. Given a code snippet \(\mathrm{C}\) and its corresponding AST \(<\mathrm{N},\mathrm{T},\mathrm{X},\mathrm{S},\delta,\varphi>\), the set of all AST terminal node pairs is denoted by \(\mathrm{TPairs}\), as shown in Formula (1):  
\[\mathrm{TPairs}(\mathrm{C})=\left\{\left(\mathrm{term_{i},term_{j}}\right) \left|\mathrm{term_{i},term_{j}}\in\mathrm{termNodes}(\mathrm{C})\wedge\mathrm{ i}\
eq\mathrm{j}\right\}\right. \tag{1}\]  
Figure 5: Model architecture diagram with attention mechanism.  
The termNodes represents the mapping between the set of terminal nodes in the code snippet and AST. In this paper, C is represented as the set of path contexts derived from it, as shown in Formula (2):  
\[\text{Rep}(\text{C})=\left\{(\text{xs},\text{p},\text{xt})\Bigg{|} \begin{array}{l}\exists(\text{terms},\text{term})\in\text{TPairs}(\text{C}): \\ \text{xs}=\phi(\text{terms})\wedge\text{xt}=\phi(\text{term})\\ \wedge\text{start}(\text{p})=\text{terms}\wedge\text{end}(\text{p})=\text{ termt}\end{array}\right\} \tag{2}\]  
The variable c can be represented as a collection of \(<\text{xs},\text{p},\text{xt}>\), where \(\text{xs}\) and \(\text{xt}\) denote the values of AST terminals, and p represents the AST path connecting them.  
The components that need to be learned in the above model include the embeddings of paths and values (vocab_value and vocab_path) and a fully connected layer (matrix W). Two embedding vocabulary matrices, vocab_value, and vocab_path, are defined in this paper, where each row of the matrix corresponds to an embedding associated with a specific object. This is represented by Formulas (3) and (4):  
\[\text{vocab\_value}\in\mathbb{R}^{|\text{X}|\times\text{d}} \tag{3}\]  
\[\text{vocab\_path}\in\mathbb{R}^{|\text{P}|\times\text{d}} \tag{4}\]  
The set X represents the collection of observed AST terminal values during the training process, while P represents the set of AST paths. The width of the matrix W is the embedding size d \(\in\) N, which is a hyperparameter determined by various constraints such as training time and model complexity. A set of path-context pairs \(\mathcal{B}=\{\text{b}_{1},\cdots,\text{b}_{n}\}\) is extracted from the given code snippet and input to the network, where \(\text{b}_{i}=\text{$<\text{xs},\text{p}_{i},\text{xt}>$}\) denotes one of the path-context pairs, and \(\text{xs}\) and \(\text{xt}\) are the values of AST terminals, and \(\text{p}_{i}\) is the path connecting them. Both the paths and contexts are mapped into their respective embedding spaces, and the three embedding spaces are concatenated into a single context vector, as shown in Formula (5):  
\[\text{c}_{i}=\text{embedding}((\text{xs},\text{p}_{i},\text{xt}_{i}))=\left[ \text{vocab\_value};\text{vocab\_path};\text{vocab\_value}_{\text{t}} \right]\in\text{R}^{3\text{d}} \tag{5}\]  
As each \(\text{c}_{i}\) is generated by concatenating three independent vectors, the fully connected layer learns to combine them. The \(\text{c}_{i}\) combines the context vector and is the output of the fully connected layer. This is expressed mathematically as shown in Formula (6):  
\[\widetilde{\text{c}}_{i}=\text{tanh}(\text{W-c}_{i}). \tag{6}\]  
The weight matrix \(\text{W}\in\mathbb{R}^{\text{d}\times 3\text{d}}\) is a trained matrix, and the hyperbolic tangent (tanh) function is applied. The height of the weight matrix W determines \(\text{c}_{i}\). Tanh is a hyperbolic tangent element-wise function, which is a commonly used monotonic nonlinear activation function with outputs ranging from (-1,1), increasing the expressive power of the model. The fully connected layer multiplies the size 3d context vector with the weight matrix to transform it into a size d combined context vector and then applies the tanh function elementwise to each vector element to transform it to the range of (-1,1).