## 4 Methodology
### Technical Details  
Following a comparison between XUL-based Firefox extensions (XML User Interface Language) and those created by Mozilla's Add-on SDK, a prototype solution was constructed using a XUL-based extension. This method allows for extensive customisation of the user interface, which a tool of this type requires and additional functionality can be gained via the links to the XPCOM (cross platform component object model) [28]. When developing Firefox extensions to capture user behaviour and provide feedback to users, a number of files are required. Extensions follow the same basic structure, with several files, which must be included. In terms of modifying an extension in an attempt to monitor user behaviour and provide cues to modify the behaviour, particular files are very important.  
The browser.xul file within the content folder contains a number of links to other required files and is essentially the foundation for the whole extension. This file has the ability to link to JavaScript files, including the jQuery library, should it need to be embedded in an extension. The file also allows additional XUL constructs to be added, allowing the menus and toolbars within Firefox to be modified e.g., adding a link into a menu to allow the user to run an extension.  
Another file, which can be modified extensively, is the JavaScript file within the content folder. It can call a number of functions, including referencing the jQuery library and can make use of the Mozilla framework. The file can manipulate the DOM (document object model) of the website displayed in the browser e.g., attach event listeners to all links on a page or modify anchor tags. Additionally, the file can utilise AJAX, passing data back and forth between a web server and the JavaScript file.  
To provide a full example of how a Firefox extension may be developed to monitor user behaviour and provide appropriate feedback, details of the Link Detector extension are outlined (Figure 2). The Link Detector extension is designed to warn users about malicious links. When the user starts the Firefox extension, the browser.xul file makes a call to the JavaScript file to run the initial function. The DOM is then manipulated, using JavaScript to add event listeners to all links on a given website. If a user approaches a link with the cursor, an event is triggered. JavaScript passes the link value to a PHP script via AJAX, and is checked against a list of known malicious links. The list of malicious links is sourced from a third-party database, which is managed and updated by Malwarebytes, the company with the anti-malware tool of the same name [29]. The AJAX request then returns a value indicating if the link is known to be malicious. If the link is flagged as being potentially dangerous, the JavaScript file then manipulates the DOM, highlighting the malicious link in red. This is repeated for each link a user approaches.  
The Link Detector is a small prototype browser extension, exploring the possibility of raising awareness regarding risky security behaviours in end-users via the use of affective feedback. As such, this may aid in preventing users revealing information to websites, which have been hijacked via an XSS attack. The final prototype developed will not be restricted to scanning for dangerous links only, and seeks to tackle a number of the threats outlined in Section 2.3.