## 3 Methodology
### XSS Triggering in Source Code
Therefore, the model does not require real-time performance at the network transmission level. ### Generalization Capability Assessment

#### 4.3.1 Evaluation on the Test Dataset

We selected data samples (approximately 20%) from the dataset that did not cross training sets or validation sets for testing. We use the proposed XSS Guardian classifier, that is, Bi-LSTM classifier with the XSS triples optimization to run the test. The results are given in the form of a standardized confusion matrix in Figure 6. For these safe samples, XSS Guardian still has an FPR of 11.76%, yet relatively small proportions. In the meantime, for the XSS-vulnerable samples, XSS Guardian has minimized the number of FNR to 2.83%. #### 4.3.2 Comparison with Similar Studies

We believe that the TOKEN method proposed by [PERSON] et al. is quite effective for the vulnerability detection of XSS. However, they did not give the published experimental code resources \begin{table}
\begin{tabular}{l c c c c c} \hline \hline
**Algorithm** & **AUC** & **F1** & **Precision** & **Recall** & **Vulnerability Recall** \\ \hline Random Forest & 0.86 & 0.82 & 0.83 & 0.82 & 0.90 \\ \hline SVM & 0.94 & 0.89 & 0.88 & 0.89 & 0.94 \\ \hline CNN & 0.93 & 0.87 & 0.87 & 0.86 & 0.87 \\ \hline LSTM & 0.95 & 0.90 & 0.89 & 0.90 & 0.95 \\ \hline
**Bi-LSTM** & **0.97** & **0.92** & **0.92** & **0.92** & **0.98** \\ \hline \hline \end{tabular}
\end{table} 
Table 5: Performance of different algorithms. Figure 6: Standardized Confusion Matrix. in the paper, only descriptive pseudocode for reference. Therefore, it is a pity for us not to reproduce their work here. However, the data set used in their paper was consistent with ours. The only enhancement we made on the dataset is to clean the spelling errors and useless code comments. Thus, we briefly cite the experimental data of this article here and make a rough comparison with the metrics of XSS Guardian in Table 6.

We found that all metrics of XSS Guardian had a certain degree of increase. Among these the recall rate had increased by 11.23%, and the F1-Score had also increased by 7.29%, due to the more detailed TOKEN sequence generation algorithms and the more advanced deep learning classifiers. The accuracy and loss curve of the XSS Guardian (Bi-LSTM model) is shown in Figure 7.

## 5 Conclusions and Future Work

In this paper, we proposed the \"Cross-Site Scripting Guardian\"--a novel approach to detect XSS vulnerability in PHP source code based on machine learning. Using our rewritten VLD, we can extract the detailed operation code and the XSS triples that describe how the code dealing with the user input. Thus, our method can be easily implemented and further extended by researchers in the follow-up research. In the experiment on the test dataset, the recall rate for vulnerability samples is as high as 98%, which also shows the importance of learning the opcode sequence and the pattern of input-output in the data stream. Besides, compared with traditional static analysis tools, the way of using a machine learning model to build a code audit detector would not be affected by the strong dependence of detection tools on matching rules. Users can constantly enrich the training samples to further improve the detection ability of the model. In future work, two directions might be further explored: First, the impact of our method on more complex data flow sources is limited. However, some hard-to-find vulnerabilities have multiple \begin{table}
\begin{tabular}{l c c c c} \hline \hline
**Method** & **Precision** & **Recall** & **F1** & **Accuracy** \\ \hline [PERSON]’s method & 0.8870 & 0.8300 & 0.8590 & 0.8890 \\ \hline XSS Guardian & 0.9200 & 0.9232 & 0.9216 & 0.9237 \\ \hline
**Improvements** & **+3.72\%** & **+11.23\%** & **+7.29\%** & **+2.36\%** \\ \hline \hline \end{tabular}
\end{table} 
Table 6: Performance of different methods. Figure 7: Accuracy and loss curve. execution branches and multiple file associations.