Feature Fusion of Pattern, Statistical, and Contextual Representations using Deep and Machine Learning for XSS Detection

Oct 14, 2026

Cross-Site Scripting (XSS) remains a critical threat to web applications, where attackers inject malicious scripts to compromise user security. Traditional detection methods face scalability and adaptability limits, and many recent machine/deep learning solutions rely on isolated features or single classifiers. This study develops two XSS detection models: early fusion combining handcrafted patterns, TF-IDF statistics, and LSTM/GRU sequential embeddings; and late fusion combining these features for seven classical classifiers. Using 13,686 payloads, early fusion achieves 99.90% accuracy (F1=99.91%), outperforming late fusion.

LanguageEnglish

CategoryPresentations

FormatPDF

Pages14

Reading Time5 min

AccessFree to download

1 INTRODUCTION

Feature Fusion of Pattern, Statistical, and Contextual Representations using Deep and Machine Learning for XSS Detection Ali Nafea Yousif 1,2, Ziyad Tariq Mustafa Al-Ta'i 1, Widad Ismail3 and Hassan Muayad Ibrahim2,4 1Department of Computer Science, College of Science, University of Diyala, 32001 Baqubah, Iraq 2 University of Information Technology and Communications, 10001 Baghdad, Iraq 3Auto-ID Laboratory (AIDL), School of Electrical and Electronic Engineering, Universiti Sains Malaysia, 14300 Nibong Tebal, Malaysia 4School of Electrical and Electronic Engineering, Engineering Campus, Universiti Sains Malaysia, 14300 Nibong Tebal, Pulau Pinang, Malaysia [scicomphd232404@uodiyala.edu.iq](scicomphd232404@uodiyala.edu.iq), [ziyad1964tariq@uodiyala.edu.iq](ziyad1964tariq@uodiyala.edu.iq), [eewidad@usm.my](eewidad@usm.my), [hassan.m@student.usm.my](hassan.m@student.usm.my) [Keyword: Cross-Site Scripting](Keyword: Cross-Site Scripting) ([XSS](XSS)), Feature Fusion, Deep Learning, Machine Learning. Abstract: Cross-Site Scripting (XSS) is still a crucial threat to web applications, enabling attackers to inject malicious scripts and compromise user security. Conventional detection methods encounter scalability and adaptability issues, while recent machine and deep learning approaches often rely on isolated features or single classifiers. This study proposes two approaches to developing XSS detection models. The first model applies an early fusion approach; it combines features derived from handcrafted patterns, statistical representations built using term frequency–inverse document frequency (TF-IDF), and sequential embeddings produced through longshort-term memory (LSTM) and gated recurrent unit (GRU) networks. The second model, based on a late feature fusion approach, extracts multiple feature types, including statistical representations from TF-IDF, handcrafted pattern-based indicators, and sequential embeddings obtained from LSTM and GRU networks, in the next stage, the concatenated feature vectors are then used to train seven well-known machine learning classifiers, including Random Forest, Support Vector Machine, AdaBoost, Decision Tree, Logistic Regression, Gaussian Naïve Bayes, and Multi-Layer Perceptron. A nearly balanced dataset of 13,686 payloads was used. The results show that early fusion achieved the best performance (LSTM+TFIDF: 99.90% accuracy, F1-score 99.91%), while late fusion (GRU+TFIDF+MLP) achieved 99.85% accuracy and an F1-score of 99.86% . These results demonstrate that early fusion improves detection sensitivity, while late fusion enables interpretability and synthesis, providing practical insights for designing robust XSS detection systems. 1 INTRODUCTION In the latest decades, there has been quick development of web technologies that turned the internet into an interactive medium from the former static information source and made real-time communication, electronic payment, and customized user experience possible. Websites are nowadays very interconnected in key industries like ecommerce, finance, health care, and social networking and deliver services for millions of activities and tasks to the end users on a day-to-day basis [1], [2] . Even though this growth has offered greater access and capability, it has also created abroader attack surface that attackers are able to exploit [3], [4] . XSS attacks have been one of the most influential and still dominate web security threats [5], by which the attackers can inject and run malicious scripts on trusted domains [6] . XSS attacks have long been among the top web security risks [7] . Attackers place malicious scripts in the system to hijack user sessions, steal login credentials, and even spread malware [8], and cause severe economic losses to major industries like e-commerce and online finance [9] . Based on these stolen cookies, the intruder can easily access other Web users'applications and get valuable information [10] . DOM-based X

FAQs

What is the core goal of the study on XSS detection?

To improve XSS detection by fusing handcrafted pattern features, TF-IDF statistical representations, and sequential embeddings from LSTM and GRU models.

How do the early fusion and late fusion approaches differ?

Early fusion combines the different feature types into a single representation before classification, while late fusion concatenates feature vectors in a later stage and then trains seven machine learning classifiers.

Which approach achieved the best performance and what were the results?

Early fusion performed best, reaching 99.90% accuracy with an F1-score of 99.91%. Late fusion achieved 99.85% accuracy with an F1-score of 99.86%.

Oct 14, 2026

Upload by Emma Wilson