## 4 Experiments and Evaluations
### Adversarial Attack Experiment Results  
We entered the XSS dataset into the adversarial model and got a batch of XSS adversarial samples after training. We organized these samples and named them the \"adversarial dataset\". The adversarial  
\begin{table}
\begin{tabular}{c c c c} \hline \hline
**Model** & **Precision** & **Recall** & **F1 Value** \\ \hline LSTM & 0.995 & 0.979 & 0.987 \\ ADTree & 0.938 & 0.936 & 0.936 \\ AdaBoost & 0.941 & 0.939 & 0.939 \\ SafeDog & 0.997 & 0.902 & 0.948 \\ XSSChop & 1.0 & 0.616 & 0.762 \\ \hline \hline \end{tabular}
\end{table}
Table 2: Comparative experiment of the XSS detection model for LSTM.  
Figure 4: Word2 Vec parameter tuning relationship diagram for LSTM.  
dataset was used to test various XSS detection software and calculate the escape rate and detection rate. Comparing the results of SafeDog, XSSChop, and the LSTM model (we named it DeepXSS), the details are shown in Table 3.  
The results of the adversarial attack showed that the escape rate of SafeDog was 14.1%, XSSChop was 9.3%, and DeepXSS was 8.25%. The XSS adversarial attack model based on reinforcement learning proposed in this paper can effectively mine the adversarial samples of the white-box and black-box detection model to escape detection. According to the results of the adversarial attack experiment, we successfully mined the general XSS escape strategy for SafeDog and the general XSS escape strategy for XSSChop, which are analyzed in the following.  
(a) The general XSS escape strategies for SafeDog and the adversarial samples for SafeDog generated according to the generic escape strategy are shown in Figure 5.  
For the filtered tags of <source>, <svg>, <img>, <iframe>, we added useless characters according to the escape action so that the number of characters between the \"<\" character and the \">\" characters was greater than a certain threshold to bypass SafeDog's detection and retained the attack function of attack vectors.  
(b) The general XSS escape strategies for XSSChop and the adversarial samples for XSSChop generated according to the generic escape strategy are shown in Figure 6.  
Next, we will further enhance the ability of the DeepXSS model to defend against adversarial attacks through the retraining model.  
Figure 5: Examples of generic XSS escape strategies for SafeDog.  
\begin{table}
\begin{tabular}{c c c} \hline \hline
**Model** & **DR** & **ER** \\ \hline SafeDog & 0.859 & 0.141 \\ XSSChop & 0.907 & 0.093 \\ Deepxss & 0.9175 & 0.0825 \\ \hline \hline \end{tabular}
\end{table}
Table 3: Adversarial result. DR, detection rate; ER, escape rate.  
On the one hand, Strategy A is as follows. A string was added before the attack vector, and its structure satisfied: \"\(<\)\" + \"space\" + \"any length of letters or numbers\" + \"=\"; at the same time, if the attack vector contained events such as onload, onerror, and so on, we needed to ensure that there was no \"space\" before the corresponding event. Finally, we could change the position of the event expression in the attack vector and replace the space with \"/\". An attack vector bypassing XSSChop detection was constructed. On the other hand, Bypass Strategy B was as follows. According to the escape action, we added an arbitrary assignment expression before onload, ontoggle, onerror, onclick, and other events of the attack vector, so that its structure satisfied \"any length of letters or numbers\" + \"<=\" + \"single or double quotes\" + \"any length of letters or numbers\" + \"single or double quotes (need to be same as the previous ones)\". The constructed attack vectors maintained the attack function of the constructed vector, and the attack vectors bypassed XSSChop detection.