Cross-Site Scripting (XSS) remains a widespread and damaging threats to web applications, as highlighted by the OWASP Top 10. While various detection methods exist, they often struggle to keep pace with the sophistication of attack vectors and obfuscation techniques. This paper implements an approach for enhancing XSS detection by leveraging modern optimizations within the transformer architecture. Our methodology uses a custom transformer encoder model trained on an aggregated dataset of nearly 100,000 samples, including newly collected XSS payloads. To enhance performance and efficiency, we integrate two key architectural improvements: Rotary Positional Embeddings (RoPE) to achieve a superior contextual understanding of HTTP payloads, and Flash Attention to significantly accelerate training and inference speeds while reducing memory consumption. Experimental results show good performance of our model that achieves an accuracy of 99.38 with high recall and precision. An ablation study demonstrates that the integrated optimizations improve detection accuracy by 0.11 percentage points, while reducing training time by approximately 32% and peak GPU memory usage by approximately 30% relative to standard Transformer configurations. Comparative evaluation against a Random Forest baseline further reveals a clear contextual understanding advantage over traditional frequency-based approaches, justifying the architectural complexity. The proposed model effectively captures structural patterns in sophisticated payloads that typically evade classical methods. This work presents an efficient, and accurate solution in real-time XSS threat detection.
References
[1]
OWASP (2025) Introduction-OWASP Top 10. https://owasp.org/Top10/2025/0x00_2025-Introduction
[2]
Stency, V.S. and Mohanasundaram, N. (2021) A Study on XSS Attacks: Intelligent Detection Methods. JournalofPhysics: ConferenceSeries, 1767, Article ID: 012047. https://doi.org/10.1088/1742-6596/1767/1/012047
[3]
Fang, Y., Li, Y., Liu, L. and Huang, C. (2018) DeepXSS: Cross Site Scripting Detection Based on Deep Learning. Proceedings of the 2018 International Conference on Computing and Artificial Intelligence, Chengdu, 12-14 March 2018, 47-51. https://doi.org/10.1145/3194452.3194469
[4]
Yan, H., Feng, L., Yu, Y., Liao, W., Feng, L., Zhang, J., et al. (2022) Cross-Site Scripting Attack Detection Based on a Modified Convolution Neural Network. FrontiersinComputationalNeuroscience, 16, Article 981739. https://doi.org/10.3389/fncom.2022.981739
[5]
Kascheev, S. and Olenchikova, T. (2020) The Detecting Cross-Site Scripting (XSS) Using Machine Learning Methods. 2020 Global Smart Industry Conference (GloSIC), Chelyabinsk, 17-19 November 2020, 265-270. https://doi.org/10.1109/glosic50886.2020.9267866
[6]
Yang, W., Zuo, W. and Cui, B. (2019) Detecting Malicious URLs via a Keyword-Based Convolutional Gated-Recurrent-Unit Neural Network. IEEEAccess, 7, 29891-29900. https://doi.org/10.1109/access.2019.2895751
[7]
Zhou, Y. and Wang, P. (2019) An Ensemble Learning Approach for XSS Attack Detection with Domain Knowledge and Threat Intelligence. Computers&Security, 82, 261-269. https://doi.org/10.1016/j.cose.2018.12.016
[8]
Kaggle (2020) Cross Site Scripting XSS Dataset for Deep Learning. https://www.kaggle.com/datasets/syedsaqlainhussain/cross-site-scripting-xss-dataset-for-deep-learning
XSSED (2015) XSSed | Cross Site Scripting (XSS) Attacks Information and Archive. http://www.xssed.com
[11]
Huyen, C. (2022) Designing Machine Learning Systems. O’Reilly Media, Inc.
[12]
PortSwigger (2024) Input Data Encoding and Obfuscation. https://portswigger.net/web-security/essential-skills/obfuscating-attacks-using-encodings
[13]
Sennrich, R., Haddow, B. and Birch, A. (2016) Neural Machine Translation of Rare Words with Subword Units. Proceedings of the 54th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), Berlin, 7-12 August 2016, 1715-1725. https://doi.org/10.18653/v1/p16-1162
[14]
Pennington, J., Socher, R. and Manning, C. (2014) Glove: Global Vectors for Word Representation. Proceedings of the 2014 Conference on Empirical Methods in Natural Language Processing (EMNLP), Doha, 25-29 October 2014, 1532-1543. https://doi.org/10.3115/v1/d14-1162
[15]
Vaswani, A., et al. (2017) Attention Is All You Need. arXiv: 1706.03762.
[16]
Noh, S. (2021) Analysis of Gradient Vanishing of RNNs and Performance Comparison. Information, 12, Article 442. https://doi.org/10.3390/info12110442
[17]
Su, J., Ahmed, M., Lu, Y., Pan, S., Bo, W. and Liu, Y. (2024) Roformer: Enhanced Transformer with Rotary Position Embedding. Neurocomputing, 568, Article ID: 127063. https://doi.org/10.1016/j.neucom.2023.127063
[18]
Burkov, A. (2025) The Hundred-Page Language Models Book: Hands-On with PyTorch. True Positive Inc.
[19]
Dao, T., Ermon, S., Fu, D., Ré, C. and Rudra, A. (2022) Flashattention: Fast and Memory-Efficient Exact Attention with IO-Awareness. Advances in Neural Information Processing Systems 35, New Orleans, 28 November-9 December 2022, 16344-16359. https://doi.org/10.52202/068431-1189
[20]
Srivastava, N., Hinton, G., Krizhevsky, A., Sutskever, I. and Salakhutdinov, R. (2014) Dropout: A Simple Way to Prevent Neural Networks from Overfitting. Journal of Machine Learning Research, 15, 1929-1958.
[21]
Goodfellow, I., Bengio, Y. and Courville, A. (2016) Deep Learning. MIT Press.
[22]
Loshchilov, I. and Hutter, F. (2019) Decoupled Weight Decay Regularization. arXiv: 1711.05101.