A BERT-Based Approach for Detecting Cross-Site Scripting Attacks

Cross-site scripting (XSS) remains one of the most persistent threats to web application security, allowing attackers to inject malicious scripts that compromise user data and system integrity. Traditional detection methods, including rule-based approaches and conventional deep learning models, often fail to handle sophisticated obfuscation techniques and context-dependent payloads. To address these challenges, this paper proposes a BERT-based detection framework that formulates XSS detection as a binary text classification task. By leveraging BERT’s deep contextual representation capabilities, the model effectively captures nuanced semantic and structural features associated with malicious input. Extensive experiments on benchmark datasets—including payloads involving JavaScript obfuscation and URL encoding—demonstrate that the proposed method consistently outperforms traditional CNN-based models, hybrid variants (CNN+NLP, CNN+LSTM), and the GPT2-based baseline across all evaluation metrics.