# Strategies and Challenges in Detecting XSS Vulnerabilities Using an Innovative Cookie Collector
## 4 Results Analysis
### Prediction
#### 4.2.3 Hierarchical Clustering  
Build a hierarchy of clusters using an agglomerative (start with individual points and group them) or divisive (start with all points and divide them) approach. Allowed analysis of hierarchical relationships: Useful for understanding relationships between groups of cookies at different levels of granularity, which helped identify subgroups of users with specific behaviors. With the implementation of these clustering algorithms, the results were as follows:  
* **User segmentation:** grouping users into clusters based on the cookies generated allows segments with similar interests and browsing behaviors to be identified. * **Personalized recommendations:** based on the identified clusters, the browser can recommend web pages relevant to each cluster's browsing patterns. * **Anomaly detection and security:** identification of cookies that do not fit normal patterns (anomalies), helping to detect possible security threats. * **User experience optimization:** improving the relevance of recommendations, providing a more personalized and efficient browsing experience for students. Implementing these algorithms allowed the browser to offer recommendations based on historical cookie data and continually adapt its recommendations as more data were collected, thus improving the accuracy and personalization of web suggestions. Figure 15 shows the dendrogram that illustrates the hierarchical groupings most derived from the hierarchical algorithm. The dendrogram represents the data groupings concerning other representations. Figure 16 shows the number of clusters (n = 10) identified by the hierarchical algorithm. The results in Table 9 indicate a good performance of hierarchical clustering; they suggest that hierarchical clustering has identified significant groups in the data, with a good cluster structure and a clear separation between them. A complete system for automatic cookie collection was assembled using bots that simulate a user's browsing behavior. Five bots were programmed, one for each browser most used by university students (Chrome, Firefox, Brave, Edge, and Opera). Web search histories of Google Chrome, Firefox, and Brave were collected from a laboratory at the University of the Armed Forces-ESPE (30 computers) between 2019 and 2024. The attributes of these databases were analyzed. A total database was created that contained all web search history. Figure 15: Preview of dendograms identified with hierarchical clustering. A test infrastructure was configured, where the five mentioned browsers were installed. A server was configured running Ubuntu with PiHole and Tshark services active. The goal was to collect all cookies generated by each URL (Cookie Dataset), capture the traffic generated during the bot search (Tshark Traffic Dataset), and associate this information with advertising or third-party domains (Third Party/Advertising Dataset). An algorithm named _BotSoul_ was developed to automate the process of accessing each URL by simulating user behavior--programmatically launching a browser, entering the web address, and navigating the site as if it were a real user. This process, which involves dynamic interaction with web elements and the execution of client-side scripts, ensures the retrieval of all cookie attributes generated during realistic browsing sessions. Cookies were captured and analyzed in real time using tools such as Wireshark, Scapy, NtopNG, Requests, and Curl. Procedures were defined within the BotSoul algorithm to check if the cookie database was empty, delete cookies, open the browser, start and end capturing traffic with Tshark, obtain HTTP headers, and obtain PiHole logs. In an initial test, each bot searched 611 domains for 4 h (approximately 152 domains per hour), generating approximately 4719 cookies. This means that each domain produced around seven cookies: one first-party and six third-party cookies. A total of 440,000 non-normalized URLs (400,000 normalized domains) were used as a search base for all bots.