Authorship Attribution of IRC Messages Using Inverse Author Frequency

Layton, Robert; McCombie, Stephen; Watters, Paul A.

doi:10.1109/ctc.2012.11

Cited by 18 publications

(15 citation statements)

References 10 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…For author attribution, Layton et al . [54] used TF–IDF weighting in the inverse author frequency (IAF) scheme and reached promising results. In a similar manner, VSM weighting with sTF–IDF gives better cross‐validation accuracy results on C10 database, compared to the test pipeline without weighting.…”

Section: Experiments and Resultsmentioning

confidence: 99%

“…The study achieved up to 61% accuracy on heterogeneous chat records. Layton et al [54] used IRC records of 50 users (50 chat messages for each). The re-centred local profile (RLP) method was used for identification.…”

Section: Chat Biometricsmentioning

confidence: 99%

“…Weighting schemes used in the experiments are (i) TF-IDF, (ii) sublinear term frequency-inverse document frequency (sTF-IDF), and (iii) entropy-logarithmic term frequency (Entropy-Log). For author attribution, Layton et al [54] used TF-IDF weighting in the inverse author frequency (IAF) scheme and reached promising results. In a similar manner, VSM weighting with sTF-IDF gives better cross-validation accuracy results on C10 database, compared to the test pipeline without weighting.…”

Section: Feature Weightingmentioning

confidence: 99%

See 2 more Smart Citations

Chat biometrics

Kuzu

Salah

2018

IET biom.

View full text Add to dashboard Cite

On-line social platforms implement moderation mechanisms to filter out unwanted content and to take action against possible cases of verbal aggression and abuse, sexual harassment, and such. In this study, the authors investigate chat biometrics, the identification of users from their verbal behaviour on a social platform. The typical application scenarios are the re-identification of banned users, returning under different identities, and aggressors operating through multiple fake accounts. They propose a novel processing pipeline, and contrast the problem with the authorship recognition problem, which is relatively well-studied in the literature. They evaluate the proposed approach on a large corpus of multiparty chat records in Turkish, which they have previously collected from a multiplayer game environment. They also introduce a new corpus in this study, collected from a well-known Turkish social platform called Ekşisözlük, in order to test the robustness of the system across domain changes, as well as on Portuguese and English news datasets to test it on different languages. They evaluate both instance-based and profile-based approaches, and provide detailed analyses with regards to the required amount of text to identify a person reliably.

show abstract

Section: Experiments and Resultsmentioning

confidence: 99%

Section: Chat Biometricsmentioning

confidence: 99%

Section: Feature Weightingmentioning

confidence: 99%

See 1 more Smart Citation

Chat biometrics

Kuzu

Salah

2018

IET biom.

View full text Add to dashboard Cite

show abstract

“…In addition, inverse-author-frequency was used within RLP, as it has been shown to improve the accuracy in applications [14].…”

Section: A Initial Clusteringmentioning

confidence: 99%

Authorship Analysis of the Zeus Botnet Source Code

Layton

Azab

2014

2014 Fifth Cybercrime and Trustworthy Computing Conference

Self Cite

View full text Add to dashboard Cite

Authorship analysis has been used successfully to analyse the provenance of source code files in previous studies. The source code for Zeus, one of the most damaging and effective botnets to date, was leaked in 2011. In this research, we analyse the source code from the lens of authorship clustering, aiming to estimate how many people wrote this malware, and what their roles are. The research provides insight into the structure the went into creating Zeus and its evolution over time. The work has potential to be used to link the malware with other malware written by the same authors, helping investigations, classification, deterrence and detection.

show abstract

“…LNG methods create a document profile for a given document by taking the L most distinctive n-grams from that document [34]. In many methods, the term 'distinctive' often means the most frequent [30] [32], while for other methods the term refers to the 'highest deviation from the average value' [38] [39]. Given two document profiles, we can calculate the distance between them by comparing these profiles, per algorithm 1.…”

Section: Authorship Attributionmentioning

confidence: 99%

Malicious Spam Emails Developments and Authorship Attribution

Alazab

Layton

Broadhurst

et al. 2013

2013 Fourth Cybercrime and Trustworthy Computing Workshop

Self Cite

View full text Add to dashboard Cite

The Internet is a decentralized structure that offers speedy communication, has a global reach and provides anonymity, a characteristic invaluable for committing illegal activities. In parallel with the spread of the Internet, cybercrime has rapidly evolved from a relatively low volume crime to a common high volume crime. A typical example of such a crime is the spreading of spam emails, where the content of the email tries to entice the recipient to click a URL linking to a malicious Web site or downloading a malicious attachment. Analysts attempting to provide intelligence on spam activities quickly find that the volume of spam circulating daily is overwhelming; therefore, any intelligence gathered is representative of only a small sample, not of the global picture. While past studies have looked at automating some of these analyses using topic-based models, i.e. separating email clusters into groups with similar topics, our preliminary research investigates the usefulness of applying authorship-based models for this purpose. In the first phase, we clustered a set of spam emails using an authorship-based clustering algorithm. In the second phase, we analysed those clusters using a set of linguistic, structural and syntactic features. These analyses reveal that emails within each cluster were likely written by the same author, but that it is unlikely we have managed to group together all spam produced by each group. This problem of high purity with low recall, has been faced in past authorship research. While it is also a limitation of our research, the clusters themselves are still useful for the purposes of automating analysis, because they reduce the work needing to be performed. Our second phase revealed useful information on the group that can be utilized in future research for further analysis of such groups, for example, identifying further linkages behind spam campaigns.

show abstract

Authorship Attribution of IRC Messages Using Inverse Author Frequency

Cited by 18 publications

References 10 publications

Chat biometrics

Chat biometrics

Authorship Analysis of the Zeus Botnet Source Code

Malicious Spam Emails Developments and Authorship Attribution

Contact Info

Product

Resources

About