Email forensic analyzing method based on community characteristics analysis

Abstract

The invention provides a massive email forensic analyzing scheme based on community network analysis and file content analysis, which solves problems that a scheme capable of realizing analysis of a community structure by utilizing receiving and sending addresses and forensic analysis by utilizing text and attatchment contents does not exist at present. The method comprises the following steps of: automatically analyzing an email data file of an Outlook client, an OE (Outlook Express) client and a Foxmail client; extracting the receiving and sending addresses, the attachment, the text, a theme and a sending mode and other information contained in the email data file; extracting an email communication relationship network built based on the receiving and sending addresses of the email and receiving and sending times; extracting the community structure of the communication relationship network through a WCMN (weighing cepstral mean normalization) algorithm; and then analyzing and calculating a suspicious degree of a community through a suspicious degree computational algorithm based on contents of the email and the attachment. According to the scheme, address information and content information of the email are fully utilized; and the community structure contained among email addresses is extracted; and the suspicious degree is provided for personnel handling cases for reference.

Description

technical field [0001] The invention belongs to the field of information security and computer application technology, and proposes a method based on social network analysis and text analysis, which mines the hidden community structure in the sending and receiving address information of massive emails, and analyzes the content of emails and attachments. Analyze the suspiciousness of the community. Background technique [0002] With the development of social economy and information technology, the incidents and disputes of crimes committed by high-tech means are increasing day by day, and the judicial evidence collection technology for crimes committed by computers has become an important and urgent problem. The purpose of computer forensics analysis is to find reliable and convincing electronic evidence or clues to criminal investigations. Therefore, computer forensics is a comprehensive interdisciplinary subject involving many fields such as computers, networks, communicati...

AI Technical Summary

Problems solved by technology

[0004] At present, the analysis and evidence collection of e-mails is mainly to analyze the content of e-mails sent and received by a single user, but there is no comprehensive mining and analysis of the correlation and communication content among the massive e-mails of multiple users, so as to extract potential criminal evidence and clues for future use. case officer reference

Images