Detecting cross-site scripting attacks

[Cedar Moore <cedar1420 () yahoo com>]

I am new to web application security, a lot of layer 7 application 
security products detect cross-site scripting attacks (ex: sanctum 
appshield). How these products do? There is lot of information about cross-
site scripting attacks but I did not came across how these web application 
attacks can be detected. Is there any white paper there out explaining the 
generic detection methods?