# Strategies and Challenges in Detecting XSS Vulnerabilities Using an Innovative Cookie Collector
## 4 Results Analysis
### Prediction
#### 4.2.1 K-Means  
The K-Means algorithm is a clustering technique that partitions data into K clusters, where each data point belongs to the cluster with the closest mean. It is one of the simplest  
Figure 8: Preview of BOOKIE, a browser to predict the level of vulnerability of students to XSS attacks.  
Figure 9: Option to display statistical results for each browsed web page.  
and most popular algorithms. Allowed the identification of common browsing patterns: Cookies with similar characteristics (e.g., lifetime and domain) were grouped, allowing common browsing behaviors to be identified between users. Clusters of cookies that reflect similar behavioral patterns were obtained: identification of user segments with common interests.  
Different clusters have been evaluated to perform a hyperparameter analysis for the proposed algorithm, and the evaluation metrics have been compared with determine the optimal number of clusters. In Figure 10, four graphs have been generated showing how the evaluation metrics vary with the number of clusters, allowing the user to quickly interpret the results and select the optimal number of clusters. We have determined that the optimal number of clusters for our analysis was 2.  
The **Silhouette Score** measures how well the data are grouped within their assigned clusters and how far apart the clusters are from each other. A value close to 1 indicates that the data are well grouped and the clusters are separated.  
The **Inertia, or Sum of Squares within the Clusters (SSE)**, measures the compactness of a cluster, defined as the sum of the squared distances between each data point and the centroid of the cluster to which it belongs. Lower values indicate that points are closer to their centroids, which generally means more compact clusters.  
The **Calinski-Harabasz Index** measures the separation between clusters and the compaction within clusters. Higher values indicate more separated and compact clusters.  
The **Davies-Bouldin Index** measures the relationship between dispersion within clusters and separation between clusters. Lower values indicate that the clusters are well separated and compact.  
Principal Component Analysis (PCA) has been applied to visualize the clusters. It is a dimensionality reduction technique that transforms a set of possibly correlated variables into a smaller set of uncorrelated variables called principal components.  
Figures 11-13 show the graph of the generated clusters. A summary of the hyperparameter evaluation using different numbers of clusters is shown in Table 7.  
Figure 10: Preview of K-MEANS Hyperparameter Analysis.  
Figure 11: Preview of K-MEANS with two clusters.  
Figure 12: Preview of K-MEANS with five clusters.  
Figure 13: Preview of K-MEANS with 10 clusters.  
For Clusters = 2, the results indicate that the clusters are very well defined and separated, although there may be some natural dispersion within them. This is usually a sign of very successful clustering, where the data points within each cluster may be spread out, but the clusters themselves are differentiated.