Digital Cyber Forensic Email Analysis and Detection Based on Intelligent Techniquesinvestigation

Abstract

The Internet has become open, public and widely used as a source of data transmission and exchanging messages between criminals, terrorists and those who have illegal motivations. Moreover, it can be used for exchanging important data between various military and financial institutions, or even ordinary citizens. One of the important means of exchanging information widely used on the Internet medium is the e-mail. Email messages are digital evidence that has been become one of the important means to adopt by courts in many countries and societies as evidence relied upon in condemnation, that prompts the researchers to work continuously to develop email analysis tool using the latest technologies to find digital evidence from email messages to assist the forensic expertise into to analyze email groups .This work presents a distinct technique for analyzing and classifying emails based on data processing and extraction, trimming, and refinement, clustering, then using the SWARM algorithm to improve the performance and then adapting support vector machine algorithm to classify these emails to obtain practical and accurate results. This framework, also proposes a hybrid English lexical Dictionary (SentiWordNet 3.0) for email forensic analysis, it contains all the sentiwords such as positive and negative and can deal with the Machine Learning algorithm. The proposed system is capable of learning in an environment with large and variable data. To test the proposed system will be select available data which is Enron Data set. A high accuracy rate is 92% was obtained in best case. The experiment is conducted the Enron email dataset corpus (May 7, 2015 Version of the dataset).

Email Security Issues, Tools, and Techniques Used in Investigation

“…Two stages of SMTP are used, one between the sender and the mail server, and another between the sender's server and the receiver's server. Since SMTP is a push protocol and a pull protocol is required at the receiver's end, either POP3 or IMAP4 can be used between the receiver's mail server and the receiver [10][11][12][13][14][15][16]. When sending messages between a client and a server, SMTP uses commands and responses.…”

“…Fraud is defined as purposeful deceit committed over email for the perpetrator's advantage or to inflict harm to others [15]. The email content comprises an offer needing little capital with a large profit margin or a sale of valuable items at a reduced price.…”

“…Many earlier research studies have been carried out in connection with a key component of email and email systems. The research conducted by Hamdi et al [15] demonstrates that email communications constitute a form of digital evidence that is increasingly being used in courts. This system also provides a hybrid English lexical Dictionary, which can be utilized for the r forensic examination of email (SentiWordNet 3.0).…”

“…Additionally, only a few tools support extended devices like USB memory sticks (Add4Mail and Digital Forensic Framework). Hamdi et al [15] presented a unique method of classifying emails based on data processing and mining, trimming and refinement, and adapting several algorithms. For email forensic analysis, they use the SWARM algorithm, as well as the hybrid English lexical dictionary SentiWordNet30 and machine learning.…”