{"id":"https://openalex.org/W7155168180","doi":"https://doi.org/10.48550/arxiv.2604.19526","title":"Evaluating LLM-Generated Obfuscated XSS Payloads for Machine Learning-Based Detection","display_name":"Evaluating LLM-Generated Obfuscated XSS Payloads for Machine Learning-Based Detection","publication_year":2026,"publication_date":"2026-04-21","ids":{"openalex":"https://openalex.org/W7155168180","doi":"https://doi.org/10.48550/arxiv.2604.19526"},"language":null,"primary_location":{"id":"doi:10.48550/arxiv.2604.19526","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2604.19526","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"type":"preprint","indexed_in":["datacite"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://doi.org/10.48550/arxiv.2604.19526","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5118644948","display_name":"Divyesh Gabbireddy","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Gabbireddy, Divyesh","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"last","author":{"id":"https://openalex.org/A5134346867","display_name":"Suman Saha","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Saha, Suman","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]}],"institutions":[],"countries_distinct_count":0,"institutions_distinct_count":0,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T12479","display_name":"Web Application Security Vulnerabilities","score":0.7667999863624573,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T12479","display_name":"Web Application Security Vulnerabilities","score":0.7667999863624573,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.10429999977350235,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":0.060100000351667404,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/cross-site-scripting","display_name":"Cross-site scripting","score":0.6517000198364258},{"id":"https://openalex.org/keywords/scripting-language","display_name":"Scripting language","score":0.6021000146865845},{"id":"https://openalex.org/keywords/obfuscation","display_name":"Obfuscation","score":0.6011999845504761},{"id":"https://openalex.org/keywords/payload","display_name":"Payload (computing)","score":0.5439000129699707},{"id":"https://openalex.org/keywords/pipeline","display_name":"Pipeline (software)","score":0.4618000090122223},{"id":"https://openalex.org/keywords/fuzz-testing","display_name":"Fuzz testing","score":0.4577000141143799},{"id":"https://openalex.org/keywords/python","display_name":"Python (programming language)","score":0.3944999873638153},{"id":"https://openalex.org/keywords/static-analysis","display_name":"Static analysis","score":0.3659999966621399},{"id":"https://openalex.org/keywords/leverage","display_name":"Leverage (statistics)","score":0.3540000021457672}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.8501999974250793},{"id":"https://openalex.org/C39569185","wikidata":"https://www.wikidata.org/wiki/Q371199","display_name":"Cross-site scripting","level":5,"score":0.6517000198364258},{"id":"https://openalex.org/C61423126","wikidata":"https://www.wikidata.org/wiki/Q187432","display_name":"Scripting language","level":2,"score":0.6021000146865845},{"id":"https://openalex.org/C40305131","wikidata":"https://www.wikidata.org/wiki/Q2616305","display_name":"Obfuscation","level":2,"score":0.6011999845504761},{"id":"https://openalex.org/C134066672","wikidata":"https://www.wikidata.org/wiki/Q1424639","display_name":"Payload (computing)","level":3,"score":0.5439000129699707},{"id":"https://openalex.org/C43521106","wikidata":"https://www.wikidata.org/wiki/Q2165493","display_name":"Pipeline (software)","level":2,"score":0.4618000090122223},{"id":"https://openalex.org/C111065885","wikidata":"https://www.wikidata.org/wiki/Q1189053","display_name":"Fuzz testing","level":3,"score":0.4577000141143799},{"id":"https://openalex.org/C519991488","wikidata":"https://www.wikidata.org/wiki/Q28865","display_name":"Python (programming language)","level":2,"score":0.3944999873638153},{"id":"https://openalex.org/C97686452","wikidata":"https://www.wikidata.org/wiki/Q7604153","display_name":"Static analysis","level":2,"score":0.3659999966621399},{"id":"https://openalex.org/C199360897","wikidata":"https://www.wikidata.org/wiki/Q9143","display_name":"Programming language","level":1,"score":0.36399999260902405},{"id":"https://openalex.org/C153083717","wikidata":"https://www.wikidata.org/wiki/Q6535263","display_name":"Leverage (statistics)","level":2,"score":0.3540000021457672},{"id":"https://openalex.org/C95623464","wikidata":"https://www.wikidata.org/wiki/Q1096149","display_name":"Classifier (UML)","level":2,"score":0.34529998898506165},{"id":"https://openalex.org/C202973057","wikidata":"https://www.wikidata.org/wiki/Q7380130","display_name":"Runtime verification","level":3,"score":0.34360000491142273},{"id":"https://openalex.org/C2780440489","wikidata":"https://www.wikidata.org/wiki/Q5227278","display_name":"Data-driven","level":2,"score":0.3206999897956848},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.31349998712539673},{"id":"https://openalex.org/C77052588","wikidata":"https://www.wikidata.org/wiki/Q644307","display_name":"Constant false alarm rate","level":2,"score":0.29510000348091125},{"id":"https://openalex.org/C197129107","wikidata":"https://www.wikidata.org/wiki/Q1921621","display_name":"Merge (version control)","level":2,"score":0.2827000021934509},{"id":"https://openalex.org/C140547941","wikidata":"https://www.wikidata.org/wiki/Q7797194","display_name":"Threat model","level":2,"score":0.28110000491142273},{"id":"https://openalex.org/C64869954","wikidata":"https://www.wikidata.org/wiki/Q1859747","display_name":"False positive paradox","level":2,"score":0.2727000117301941},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.2720000147819519},{"id":"https://openalex.org/C169590947","wikidata":"https://www.wikidata.org/wiki/Q47506","display_name":"Compiler","level":2,"score":0.27140000462532043},{"id":"https://openalex.org/C79403827","wikidata":"https://www.wikidata.org/wiki/Q3988","display_name":"Real-time computing","level":1,"score":0.2651999890804291},{"id":"https://openalex.org/C175309249","wikidata":"https://www.wikidata.org/wiki/Q725864","display_name":"Pipeline transport","level":2,"score":0.26420000195503235},{"id":"https://openalex.org/C2777548347","wikidata":"https://www.wikidata.org/wiki/Q5456937","display_name":"Flagging","level":2,"score":0.26249998807907104},{"id":"https://openalex.org/C37736160","wikidata":"https://www.wikidata.org/wiki/Q1801315","display_name":"Adversarial system","level":2,"score":0.26159998774528503},{"id":"https://openalex.org/C2779639559","wikidata":"https://www.wikidata.org/wiki/Q7661178","display_name":"Symbolic execution","level":3,"score":0.25690001249313354},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.2533000111579895},{"id":"https://openalex.org/C2776401178","wikidata":"https://www.wikidata.org/wiki/Q12050496","display_name":"Feature (linguistics)","level":2,"score":0.25270000100135803},{"id":"https://openalex.org/C120314980","wikidata":"https://www.wikidata.org/wiki/Q180634","display_name":"Distributed computing","level":1,"score":0.2524999976158142}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.48550/arxiv.2604.19526","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2604.19526","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":null,"raw_source_name":null,"raw_type":"Preprint"}],"best_oa_location":{"id":"doi:10.48550/arxiv.2604.19526","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2604.19526","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"sustainable_development_goals":[],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":0,"referenced_works":[],"related_works":[],"abstract_inverted_index":{"Cross-site":[0],"scripting":[1],"(XSS)":[2],"remains":[3],"a":[4,18,67,93,104,133,156],"persistent":[5],"web":[6],"security":[7,221],"vulnerability,":[8],"especially":[9],"because":[10],"obfuscation":[11,145],"can":[12,198],"change":[13],"the":[14,58,125,148,159,206,210,213,226,234],"surface":[15],"form":[16],"of":[17,138,215,228,236],"malicious":[19],"payload":[20,101],"while":[21,140],"preserving":[22],"its":[23],"behavior.":[24,174],"These":[25],"transformations":[26],"make":[27],"it":[28],"difficult":[29],"for":[30,43,70,239],"traditional":[31],"and":[32,72,91,212,224],"machine":[33],"learning-based":[34],"detection":[35,188,241],"systems":[36],"to":[37,99,112,151,167,219],"reliably":[38],"identify":[39],"attacks.":[40],"Existing":[41],"approaches":[42],"generating":[44,71],"obfuscated":[45,74],"payloads":[46,76,184],"often":[47],"emphasize":[48],"syntactic":[49,121],"diversity,":[50],"but":[51],"they":[52],"do":[53],"not":[54,186],"always":[55],"ensure":[56],"that":[57,162,170,181],"generated":[59,110,183,196,237],"samples":[60,111,197],"remain":[61],"behaviorally":[62],"valid.":[63],"This":[64,108],"paper":[65],"presents":[66],"structured":[68],"pipeline":[69,83],"evaluating":[73],"XSS":[75],"using":[77],"large":[78],"language":[79,130],"models":[80,218],"(LLMs).":[81],"The":[82],"combines":[84],"deterministic":[85],"transformation":[86],"techniques":[87],"with":[88],"LLM-based":[89],"generation":[90,223],"uses":[92],"browser-":[94],"based":[95],"runtime":[96,117,134,173,229],"evaluation":[97,178],"procedure":[98],"compare":[100],"behavior":[102,118,135,230],"in":[103,190,232],"controlled":[105],"execution":[106],"environment.":[107],"allows":[109],"be":[113,199],"assessed":[114],"through":[115],"observable":[116],"rather":[119],"than":[120],"similarity":[122],"alone.":[123],"In":[124],"evaluation,":[126],"an":[127],"untuned":[128],"baseline":[129],"model":[131],"achieves":[132],"match":[136,149],"rate":[137,150],"0.15,":[139],"fine-tuning":[141],"on":[142],"behavior-preserving":[143],"source-target":[144],"pairs":[146],"improves":[147],"0.22.":[152],"Although":[153],"this":[154,191],"represents":[155],"measurable":[157],"improvement,":[158],"results":[160],"show":[161],"current":[163],"LLMs":[164],"still":[165],"struggle":[166],"generate":[168],"obfuscations":[169],"preserve":[171],"observed":[172],"A":[175],"downstream":[176,240],"classifier":[177],"further":[179],"shows":[180],"adding":[182],"does":[185],"improve":[187],"performance":[189],"setting,":[192],"although":[193],"behavior-":[194],"filtered":[195],"incorporated":[200],"without":[201],"materially":[202],"degrading":[203],"performance.":[204],"Overall,":[205],"study":[207],"demonstrates":[208],"both":[209],"promise":[211],"limits":[214],"applying":[216],"generative":[217],"adversarial":[220],"data":[222,238],"emphasizes":[225],"importance":[227],"checks":[231],"improving":[233],"quality":[235],"systems.":[242]},"counts_by_year":[],"updated_date":"2026-07-28T07:46:37.118299","created_date":"2026-04-23T00:00:00"}