## 3 Methodology
### XSS Triggering in Source Code
```
1<script>echo$tainted;</script>
2 echo\"<\".$tainted.\"href=\"/bob\"/>\";
3 echo\"x=\"\"\".$tainted.\"\"\";
4 echo\"body{color:\"\"\".$tainted.\"\"\";}
5 echo\"alert(\"\"\"/$tainted.\"\"\")\";
6 echo\"<divid=\".$tainted.\">content</div>\";
7 echo\"divomnousover=\"x=\"\".$tainted.\"\"\";
```

Listing 2: Examples of sinks. Based on the classification results of [PERSON] et al., and combined with the report of an XSS vulnerability in CVE/CWE [38], we suppose that the identification of sink type needs to be considered based on the following points [39]. **The location of output content in the document**: Due to the different code logic, untrustworthy input may reach anywhere on the page and be broken through a specifically constructed payload. Based on this, we first classify sink into three categories: (1) HTML, which is the most common type. The user's input will be applied to a certain part of the HTML document. (2) CSS. Some web pages allow the users to change the CSS layout of the page through some options, such as background color, which is often ignored as the XSS vulnerability. (3) JavaScript, in which some untrustworthy parameters will be introduced into the script to participate in the execution. In this case, the code injected by the attacker is easier to break through the original logic and would be more harmful. **HTML tag type of output context**: The design of a web page based on the tag makes XSS's payload needs to be carefully constructed to make use of the tag structure of its trigger position. Whether the output position is within the braces of the \"style\" tag or the content of the \"div\" tag cannot be generalized. Therefore, the context tag where the output content is located is also an important basis for classification. **Location of output in relation to contextual HTML tags**: Based on the second point, the position of the output content in its context needs further analysis. For example, a common example is contaminated data output within a pair of span tags, and sometimes this data will be applied to the \"a\" tag's \"href\" attribute. Even in some programs, page tag names or attribute names are designed to be changed by untrustworthy sources. Therefore, these situations deserve a classified discussion. **How the output content is closed**: For programmers, what they expect is that the normal user input will be inserted into the corresponding page position. Therefore, the data from the user is often closed by the original quotes, brackets, and other symbols in the document. For attackers, their constructed payload needs to use the corresponding symbols to close the original symbols in advance, and then insert the part they want to execute. In many cases, preventing attackers at output content closing positions in advance can effectively prevent XSS attacks. For example, the function _addslashes_ can add escape characters to quotation marks in data submitted by attackers to convert them into normal text. Based on four points above, we distinguish the sink type easily. The identification result is shown in Table 3, self-defined OPCODEs are used to replace the single \"\(ECHO\)\". ### OPCODE Sequence Embedding

Operand sequences are a type of discrete text, and the simple encoding of such text for subsequent classification can cause major difficulties in the gradient optimization process. Therefore, we need suitable methods to map the discrete text into a continuous vector space. Referring to some methods in the natural language processing field, each opcode sequence can be treated as a document. In this way, an embedding algorithm can transfer the opcode sequence to a vector array. \"Word2 vec\" [40] is a commonly used pre-training model applied in the field of natural language processing, which can be used to generate a text vector order with contextual properties. It integrates the CBOW, Skip-Gram two language models as well as the MLP neural network structure, which can generate its separate fixed dimension vector for each word in the corpus.