A temporal based forensic analysis of electronic communication

ABSTRACT

Previous work [1] reported on our research in developing a data mining environment for analyzing email communication data. In this paper, we describe our extensions to EMT for applying forensic discovery over temporal email data. The goal is to produce a semi-automatic system to aid in evidence discovery and a host of other applications. We describe our research on profile stability, temporal search and clustering, and new social network dynamic algorithms.

REFERENCES

• 1: Shlomo Hershkop , Salvatore J. Stolfo, Behavior-based email analysis with application to spam detection, Columbia University, New York, NY, 2006
• 2: Culotta, A., Bekkerman, R. and McCallum, A. Extracting Social Networks and Contact Information from Email and the Web. First Conference on Email and Anti-Spam (CEAS), Mountain View CA, 2004.
• 3: Danah Boyd , Jeffrey Potter, Social network fragments: an interactive tool for exploring digital social connections, ACM SIGGRAPH 2003 Sketches & Applications, July 27-31, 2003, San Diego, California [doi>10.1145/965400.965437]
• 4: Salvatore J. Stolfo , Shlomo Hershkop, Email mining toolkit supporting law enforcement forensic analyses, Proceedings of the 2005 national conference on Digital government research, May 15-18, 2005, Atlanta, Georgia

INDEX TERMS

Primary Classification:
  H. Information Systems
  H.4 INFORMATION SYSTEMS APPLICATIONS

Additional Classification:
  H. Information Systems
  H.4 INFORMATION SYSTEMS APPLICATIONS
      H.4.3 Communications Applications

General Terms:
Algorithms, Theory

Keywords:
email mining, email visualizations, histograms, search, social networks