Feature Fusion of Pattern, Statistical, and Contextual Representations using Deep and Machine Learning for XSS Detection

Abstract

Cross-Site Scripting (XSS) is still a crucial threat to web applications, enabling attackers to inject malicious scripts and compromise user security. Conventional detection methods encounter scalability and adaptability issues, while recent machine and deep learning approaches often rely on isolated features or single classifiers. This study proposes two approaches to developing XSS detection models. The first model applies an early fusion approach; it combines features derived from handcrafted patterns, statistical representations built using term frequency–inverse document frequency (TF-IDF), and sequential embeddings produced through long- short-term memory (LSTM) and gated recurrent unit (GRU) networks. The second model, based on a late feature fusion approach, extracts multiple feature types, including statistical representations from TF-IDF, handcrafted pattern-based indicators, and sequential embeddings obtained from LSTM and GRU networks, in the next stage, the concatenated feature vectors are then used to train seven well-known machine learning classifiers, including Random Forest, Support Vector Machine, AdaBoost, Decision Tree, Logistic Regression, Gaussian Naïve Bayes, and Multi-Layer Perceptron. A nearly balanced dataset of 13,686 payloads was used. The results show that early fusion achieved the best performance (LSTM+TFIDF: 99.90% accuracy, F1-score 99.91%), while late fusion (GRU+TFIDF+MLP) achieved 99.85% accuracy and an F1- score of 99.86%. These results demonstrate that early fusion improves detection sensitivity, while late fusion enables interpretability and synthesis, providing practical insights for designing robust XSS detection systems.