Self-Lightweight Machine Learning Model for XSS Attack Detection in Web Forms

Abstract

Cross-Site Scripting (XSS) attacks remain one of the most impactful attacks and a major threat to web applications, especially when malicious payloads are stuffed via email input. Although advanced learning solutions have achieved significant detection, their computational and time-consuming heuristics often prevent their deployment in resource-limited environments, such as shared hosting or edge sites. This paper presents a lightweight machine learning approach designed to instantly detect XSS attacks originating from web forms. The model is capable of operating independently without relying on external resources or systems (such as cloud services or large detection engines). The proposed solution focuses on a combined feature set consisting of fast-to-calculate syntactic and lexical indicators (such as tag count, suspicious token frequency, coding markup, and entropy). Simple and well-established classifiers—logistic regression, random forest, and LightGBM—were used, focusing on detection effectiveness (precision, recall, F1, and AUC) and operational constraints (inference time per sample and model size). To reflect real-world conditions, the experiments combine generic XSS payloads, benign sample templates, and synthetically modified payloads that mimic the obfuscation and encryption techniques used by attackers. The results are lightweight, low-effort, and highly accurate, and they compete with heavier competitors, with significantly lower semantic and memory footprint costs.