LinkGuard is the key component of the implementation. It is a stand alone windows program with GUI (graphic user interface). It's composed of 5 parts as illustrated in Fig. 3: Analyzer, Alerter, Logger, Comm, and Database. The functionalities of these 5 parts are given below:
Comm: Communicate with the whook.dll of all of the monitored processes, collect data related to user input from other processes (e.g. IE, outlook, firefox, etc.), and send these data to the Analyzer, it can also send commands (such as block the phishing sites) from the LinkGuard executive to whook.dll. The communication between the LinkGuard process and other processes is realized by the shared memory mechanism provided by the operating system.
Database: Store the whitelist, blacklist, and the user input URLs.
Analyzer: It is the key component of LinkGuard, which implements the LinkGuard algorithm,. It uses data provided by Comm and Database, and sends the results to the Alert and Logger modules.
Alerter: When receiving a warning messages from Analyzer, it shows the related information to alert the users and send back the reactions of the user back to the Analyzer.
Logger: Archive the history information, such as user events, alert information, for future use.