A novel approach of mining write-prints for authorship attribution in e-mail forensics

TLDR

Cybercrime via anonymous e‑mails is rising, and authorship attribution seeks to identify the most plausible author among suspects, yet prior work has focused on classification accuracy with limited attention to evidence quality. The paper proposes a data‑mining method that captures each suspect’s write‑print by modeling frequent feature combinations in their e‑mails. The method uses frequent‑pattern mining to model suspect write‑prints, a novel application of this technique to authorship attribution. The approach yields unique, court‑ready write‑prints that reliably identify authors, as confirmed by experiments on real‑life e‑mails.

Abstract

There is an alarming increase in the number of cybercrime incidents through anonymous e-mails. The problem of e-mail authorship attribution is to identify the most plausible author of an anonymous e-mail from a group of potential suspects. Most previous contributions employed a traditional classification approach, such as decision tree and Support Vector Machine (SVM), to identify the author and studied the effects of different writing style features on the classification accuracy. However, little attention has been given on ensuring the quality of the evidence. In this paper, we introduce an innovative data mining method to capture the write-print of every suspect and model it as combinations of features that occurred frequently in the suspect's e-mails. This notion is called frequent pattern, which has proven to be effective in many data mining applications, but it is the first time to be applied to the problem of authorship attribution. Unlike the traditional approach, the extracted write-print by our method is unique among the suspects and, therefore, provides convincing and credible evidence for presenting it in a court of law. Experiments on real-life e-mails suggest that the proposed method can effectively identify the author and the results are supported by a strong evidence.