## 3 Methodology
### XSS Triggering in Source Code
Bidirectional LSTM [42] can capture the bidirectional semantic dependence of sequence better by concatenating the network structure of LSTM. The Bi-LSTM structure is shown in Figure 3.

In the forward network (LSTM Left), we input \"_ASSIGN\"_, \"_CONCAT_\", and \"_ATTR_NAME_\" and get three vectors \(\{L_{0},L_{1},L_{2}\}\). In the backward network (LSTM right), we input \"_ATTR_NAME_\", \"_CONCAT_\", and \"_ASSIGN\"_ and get three vectors \(\{R_{0},R_{1},R_{2}\}\). Finally, the forward and backward hidden vectors are concatenated and we get \(\{[L_{0},R_{0}],[L_{1},R_{1}],[L_{2},R_{2}]\}\) as \(\{H_{0},H_{1},H_{2}\}\). By doing this, the neural network can learn the context information of the two directions in the whole sequence processing. For the classification task completed in this paper, we suppose the bidirectional LSTM network is the optimal NN structure since it can deal with all the information of forward and backward. Figure 3: The bidirectional long short-term memory (Bi-LSTM) structure. In our case, due to the different functions of the code, each PHP source code will have different lengths of operation code after conversion to the sequence of operations code. After the embedding process, each word will become a sequence of vectors of unequal length, which does not conform to the input rule of the neural network. We uniformly specify each vector sequence length as L when processing the vector sequence of the sample when L needs to be larger than the maximum sample sequence length. The insufficient parts will be filled with float numeric value 0. The mask layer is used in the front layer of the neural network to mask out the shadow of the 0 values on subsequent calculations. After that, the neural network will access the bidirectional LSTM layer, which contains a two-direction LSTM network structure. The sequence genus of two directions can be learned after concatenating the input sequence. Finally, we append a dense layer as well as a softmax layer to obtain the classification results of the input samples. Besides, as the MLP network has been used in the word2 vec pre-training model for semisupervised learning of the smaller corpus of opcode sequences, we do not import more complex deep neural networks to the classifier for increasing the complexity of the model. ## 4 Experiments and Performances

### Experiments Setup

In the experiment shown below, we first carried out experiments on different classifiers and compare their performances. Second, for the different degrees of refinement of XSS triples in the OPCODE, we did some comparative experiments on the classifier with the best performance (i.e., the Bi-LSTM classifier) to prove the importance of the triples for PHP source-level XSS vulnerability detection. In the meantime, we gave the curve of loss-accuracy of the validation set and the confusion matrix on the test set throughout the training and evaluating process. At last, we compared the performance of our proposed XSS Guardian with the study done on the same data set to highlight its excellent performance. **Data**: We ran experiments on different levels of proposed XSS Guardian. The Common Weakness Enumeration (CWE) is a category system for software weaknesses and vulnerabilities. We adopted CWE-079 as our dataset, which includes 10080 XSS-related PHP source code samples. To be precise, CWE-079 contains 5278 safe code blocks and 4352 unsafe ones. Before these experiments, we have removed possible interference from the code samples, such as extra blank lines and code comments. **Model Training and metric selection**: In the neural network training and validating, we use a validation split of 10% in each epoch. As for the traditional machine learning algorithms, we use 10 fold cross-validation for model training and selection of optimal hyperparameters. For the numbers given below, we use the highest experimental metrics on the validation set (no cross with training set).