# Detection of Reflected XSS Vulnerabilities Based on Paths-Attention Method
## 2 Related Work
By analyzing the intermediate representation of source code, they obtained control flow graph features of intermediate language, initialized basic block vectors using word embedding algorithm to extract semantic information from code, concatenated them to generate sample data for detection, and achieved intelligent function-level code vulnerability detection. [PERSON] et al. proposed a WFG similarity-based code vulnerability detection method, which slices CFG graphs with vulnerability-sensitive keywords, calculates node weights in CFG subgraphs to generate WFG graphs, uses bipartite matching algorithm to calculate WFG similarity, and thus completes similarity-based code vulnerability detection. Detecting XSS vulnerabilities from the perspective of graph neural networks is also an innovative approach. Analyzing website source codes and converting them into dependency or control flow graphs can eliminate language barriers and reduce manual costs while improving accuracy of detections as well. However, converting website source codes into graphs and learning their features requires significant computation power; moreover, convolution during learning by GNNs may cause loss of some feature information; therefore, although there has been improvement in efficiency and accuracy of detections it has not yet reached ideal levels. [PERSON] et al. proposed a deep-learning-based software vulnerability detection system, which targets software source code and determines the importance of keywords by counting their frequency in the code and detects software vulnerabilities by forming code gadgets mixed with control dependencies. However, this method can currently only detect multicategory vulnerabilities related to API calls in C/C++ programs(version 17). [PERSON] et al. proposed a code vulnerability detection method based on code similarity [14], which introduced a dataset of (vulnerability-vulnerability) and (vulnerability-patch), and detected vulnerabilities by comparing the similarity between vulnerability-vulnerability pairs and the difference between vulnerability-patch pairs. This method uses Siamese networks, BiLSTM, and attention as detection models, treats website source codes as text from the perspective of natural language processing, and extracts feature from source codes using some natural language processing methods for XSS vulnerability detection. Although these methods using natural language processing can demonstrate high accuracy and recall rates, it is difficult for the above model's code similarity-based detection method to distinguish between vulnerable features among similar codes. This article proposes a code semantic-based reflection-type XSS vulnerability detection method to address the shortcomings of the existing model. The main research work is as follows:From the perspective of code semantics, using the paths-attention model for reflection-type XSS vulnerability detection, applying advanced methods in natural language processing to the field of vulnerability detection, and adjusting experiments to obtain a superior detection model. 2. Constructing a reliable dataset. Currently, most datasets for reflection-type XSS vulnerability detection suffer from imbalanced positive and negative samples. To avoid this problem, this article selects files numbered WEC80 XSS from the National Institute of Standards and Technology's (NIST) Software Assurance Reference Dataset (SARD) as negative samples and real project code data as positive samples [15]. 3. Implementing the vulnerability detection method. Based on a real-world vulnerability dataset, this article conducted simulation experiments that showed that our proposed vulnerability detection method has advantages in both efficiency and accuracy.