Research on Feature Modeling and Preprocessing Methods for Cross-Site Scripting Attack Detection

Cross site scripting attacks (XSS) are one of the main security threats facing current web applications, and attackers often use multi-layer encoding and obfuscation techniques to evade traditional detection mechanisms.This paper proposes an improved feature modeling and preprocessing method to address the issues of incomplete semantic restoration of multiple obfuscated scripts in the preprocessing stage and ignoring cross domain contextual associations between HTML and JavaScript in the feature modeling stage.The core of this method includes: 1) a layered trigger decoding mechanism that achieves efficient and accurate semantic restoration of complex obfuscated payloads through a detection driven recursive decoding strategy; 2) A domain aware feature modeling method that combines HTML structural features with JavaScript behavioral features to construct a joint feature representation that captures cross domain semantics.To verify the effectiveness of the method, this paper crawled and annotated a dataset containing 30000 samples based on the open-source XSS vulnerability library XSSed and real network traffic.The experimental results on this dataset show that the proposed method outperforms traditional preprocessing processes in terms of accuracy, recall, and F1 score.In addition, compared with mainstream deep learning models, this method improves inference speed by only 2.1 ms/sample while maintaining a considerable detection accuracy of F1 Score 99.59%, demonstrating its practical value and potential in web security applications that require high real-time performance and low resource consumption.