# XSShield: Defending Against Stored XSS Attacks Using LLM-Based Semantic Understanding
## 3 XSShield Design
### Data Adaptor
#### 3.2.1 PDG Generator
```
Input: Program Dependency Graph \(G(V,E)\), control weight \(w_{c}\), data weight \(w_{d}\), AST node limit \(\theta_{ast}\) Output: Set of program subgraphs \(S\) /* Phase 1: Weighted Graph Constructor */
1:for all each edge \(e\in E\)do
2:if\(e\in\text{ControlFlow}(G)\)then
3:\(w(e)\gets w_{c}\)
4:else
5:\(w(e)\gets w_{d}\)
6:endif
7:endfor
8: /* Phase 2: Enhanced Community Detector */
9:\(\mathcal{C}\leftarrow\{(v):v\in V\}\)
10:\(Q_{\text{prev}}\leftarrow-\infty\)
11:\(Q_{\text{curr}}\leftarrow\text{Modularity}(G,\mathcal{C})\)
12:while\(Q_{\text{curr}}>Q_{\text{prev}}\)do
13:for all each \(v\in V\)do
14:\(c^{*}\leftarrow\arg\max_{c\in\mathcal{C}}\Delta Q(v,c)\)
15:if\(N_{AST}(c^{*})+\text{ASTNodes}(v)\leq\theta_{ast}\)then
16: Reassign \(v\) to community \(c^{*}\)
17:else
18: Create new community for \(v\)
19:endif
20:endfor
21:\(\mathcal{C}\leftarrow\text{Aggregate}(\mathcal{C})\)
22:\(Q_{\text{prev}}\gets Q_{\text{curr}}\)
23:\(Q_{\text{curr}}\leftarrow\text{Modularity}(G,\mathcal{C})\)
24:endwhile
25:return\(\mathcal{C}\)
```

**Algorithm 2** PDG Partitioning via Community Detection. During community detection, we ensure that the number of AST nodes in each community does not exceed the predefined limit \(\theta_{ast}\). If adding a node to a community would result in \(N_{AST}(C)>\theta_{ast}\), that node is assigned to a different community or creates a new one. This ensures that generated subgraphs, when provided as input to the LLM, maintain controlled token length. Our modifications to the Louvain algorithm [29] aim to maximize \(Q\) while efficiently identifying well-formed, functionally meaningful subgraphs consistent with JavaScript program structures. The modularity gain \(\Delta Q\) when relocating node \(i\) to community \(C\) is calculated as:

\[\Delta Q=\left[\frac{\Sigma_{in}+k_{i,in}}{2m}-\left(\frac{\Sigma_{tot}+ki}{2m} \right)^{2}\right]-\left[\frac{\Sigma_{in}}{2m}-\left(\frac{\Sigma_{tot}}{2m} \right)^{2}-\left(\frac{ki}{2m}\right)^{2}\right]-\lambda\cdot\Delta N_{AST}( \mathcal{C}) \tag{5}\]

where \(\Sigma_{in}\) represents the total weight of edges within community \(C\), \(k_{i,in}\) is the weight of edges connecting node \(i\) to other nodes in community \(C\), \(\Sigma_{tot}\) represents the total weight of all edges connected to nodes in community \(C\), \(k_{i}\) is the total weight of all edges connected to node \(i\), and \(\Delta N_{AST}(C)\) represents the change in AST node constraint when adding node \(i\) to community \(C\). Through this penalty term, the modularity calculation directly incorporates AST node constraints. Through this method, our enhanced community-detection algorithm efficiently identifies well-structured and functionally clear subgraphs that maintain consistency with the overall structure of JavaScript programs. #### 3.2.3 Code Representation Generator

We achieved a Code Representation Generator capable of transforming PDGs into optimized formats adapted for LLM while ensuring semantic integrity. After completing PDG construction and logical subgraph partitioning, this generator utilizes native code format to generate code representations specifically for LLM analysis, thereby fully leveraging LLM's advantages in processing source code. The generator employs a two-phase processing approach: the first phase systematically traverses AST nodes in the PDG, maintaining the program's original structure through explicit mapping of control and data flow dependencies; the second phase performs controlled code restructuring, preserving key semantic associations identified during dependency analysis by applying context-aware transformation rules that prioritize critical program behaviors. The entire transformation process consistently follows strict semantic fidelity protocols verified through cross-validation with original program-execution traces. The final generated code representation serves as behavioral features, effectively preserving the structural characteristics and semantic properties of the target program.