Machine Learning for Authorship Attribution and Cyber Forensics

1 CYBERSECURITY AND CYBERCRIME INVESTIGATION 1.1 CYBERSECURITY 1.2 KEY COMPONENTS TO MINIMIZING CYBERCRIMES 1.3 DAMAGE RESULTING FROM CYBERCRIME 1.4 CYBERCRIMES 1.4.1 Major Categories of Cybercrime 1.4.2 Causes of and Motivations for Cybercrime 1.5 MAJOR CHALLENGES 1.5.1 Hacker Tools and Exploit Kits 1.5.2 Universal Access 291.5.3 Online Anonymity 1.5.4 Organized Crime 301.5.5 Nation State Threat Actors 311.6 CYBERCRIME INVESTIGATION 322 MACHINE LEARNING FRAMEWORK FOR MESSAGING FORENSICS 342.1 SOURCES OF CYBERCRIMES 362.2 FEW ANALYSIS TOOLS AND TECHNIQUES 382.3 PROPOSED FRAMEWORK FOR CYBERCRIMES INVESTIGATION 392.4 AUTHORSHIP ANALYSIS 412.5 INTRODUCTION TO CRIMINAL INFORMATION MINING 432.5.1 Existing Criminal Information Mining Approaches 442.5.2 WordNet-based Criminal Information Mining 472.6 WEKA 483 HEADER-LEVEL INVESTIGATION AND ANALYZING NETWORK INFORMATION 503.1 STATISTICAL EVALUATION 523.2 TEMPORAL ANALYSIS 533.3 GEOGRAPHICAL LOCALIZATION 533.4 SOCIAL NETWORK ANALYSIS 553.5 CLASSIFICATION 563.6 CLUSTERING 584 AUTHORSHIP ANALYSIS APPROACHES 594.1 HISTORICAL PERSPECTIVE 594.2 ONLINE ANONYMITY AND AUTHORSHIP ANALYSIS 604.3 STYLOMETRIC FEATURES 614.4 AUTHORSHIP ANALYSIS METHODS 634.4.1 Statistical Analysis Methods 644.4.2 Machine Learning Methods 644.4.1 Classification Method Fundamentals 664.5 AUTHORSHIP ATTRIBUTION 674.6 AUTHORSHIP CHARACTERIZATION 694.7 AUTHORSHIP VERIFICATION 704.8 LIMITATIONS OF EXISTING AUTHORSHIP TECHNIQUES 725 AUTHORSHIP ANALYSIS - WRITEPRINT MINING FOR AUTHORSHIP ATTRIBUTION 745.1 AUTHORSHIP ATTRIBUTION PROBLEM 785.1.1 Attribution without Stylistic Variation 795.1.2 Attribution with Stylistic Variation 795.2 BUILDING BLOCKS OF THE PROPOSED APPROACH 805.3 WRITEPRINT 875.4 PROPOSED APPROACHES 875.4.1 AuthorMiner1: Attribution without Stylistic Variation 885.4.2 AuthorMiner2: Attribution with Stylistic Variation 926 AUTHORSHIP ATTRIBUTION WITH FEW TRAINING SAMPLES 976.1 PROBLEM STATEMENT AND FUNDAMENTALS 1006.2 PROPOSED APPROACH 1016.2.1 Preprocessing 1016.2.2 Clustering by Stylometric Features 1026.2.3 Frequent Stylometric Pattern Mining 1046.2.4 Writeprint Mining 1056.2.5 Identifying Author 1066.3 EXPERIMENTS AND DISCUSSION 1067 AUTHORSHIP CHARACTERIZATION 1137.1 PROPOSED APPROACH 1157.1.1 Clustering Anonymous Messages 1167.1.2 Extracting Writeprints from Sample Messages 1167.1.3 Identifying Author Characteristics 1167.2 EXPERIMENTS AND DISCUSSION 1178 AUTHORSHIP VERIFICATION 1208.1 PROBLEM STATEMENT 1238.2 PROPOSED APPROACH 1258.2.1 Verification by Classification 1268.2.2 Verification by Regression 1268.3 EXPERIMENTS AND DISCUSSION 1278.3.1 Verification by Classification. 1288.3.2 Verification by Regression 1289 AUTHORSHIP ATTRIBUTION USING CUSTOMIZED ASSOCIATIVE CLASSIFICATION 1319.1 PROBLEM STATEMENT 1329.1.1 Extracting Stylometric Features 1329.1.2 Associative Classification Writeprint 1339.1.3 Refined Problem Statement 1369.2 CLASSIFICATION BY MULTIPLE ASSOCIATION RULE FOR AUTHORSHIP ANALYSIS 1379.2.1 Mining Class Association Rules 1379.2.2 Pruning Class Association Rules 1399.2.3 Auth