Analyzing Instant Messaging Writeprints as a Behavioral Biometric Element of Cybercrime Investigations

The anonymous nature of the Internet and increasing cybercrime creates a growing need for techniques to assist in identifying online cybercrime suspects as part of the investigation. In instant messaging (IM) communications, cyber criminals use virtual identities to hide their true identity, which hinders social accountability and facilitates cybercrime. Cyber criminals may use multiple screen names, impersonate other users, or supply false information on their virtual identities with the intention of deceiving unsuspecting victims and committing various cybercrimes. It is necessary to have IM cyber forensics techniques to assist in identifying cyber criminals and collecting digital evidence as part of the investigation.;Behavioral biometrics are persistent personal traits and patterns of behavior that may be collected and analyzed to aid a cybercrime investigation. Instant messaging behavioral biometrics include online writing habits, known as stylometric features, which may be used to create an author writeprint to assist in identifying an author, or characteristics of an author, of a set of instant messages. The writeprint is a digital fingerprint that represents an author's distinguishing stylometric features that occur in his/her computer-mediated communications. Writeprints can provide cybercrime investigators a unique tool for analyzing IM-assisted cybercrimes. They may be used as input to a criminal cyberprofile and as an element of a multimodal system for cybercrime investigations. Writeprints can be used in conjunction with other evidence, investigation techniques, and biometrics techniques to reduce the potential suspect space to a certain subset of suspects; identify the most plausible author of an IM conversation from a group of suspects; link related crimes; develop an interview and interrogation strategy; and gather convincing digital evidence to justify search and seizure and provide probable cause.;The purpose of this dissertation is to create and analyze behavioral biometrics- based instant messaging writeprints as cyber forensics input for cybercrime investigations. This research uses authorship analysis techniques to create a set of stylometric features robust enough to show separation between authors and between author categories. The real time, casual nature of instant messaging communications offers several interesting stylometric features such as message structure, unusual language usage, and special stylistic markers that are useful in forming a suitable writeprint feature set for authorship analysis. This research uses the Principal Component Analysis (PCA) and multivariate Gaussian distribution (MGD) methods to analyze IM conversation logs from two distinct data sets for authorship identification and characterization. Authorship identification may be applied to IM to assist in identifying criminals who hide their true identity or impersonate a known individual. Authorship characterization may be used to help discover IM cyber criminals who supply false information in their virtual identities, such as gender.;The research results presented in this dissertation demonstrate that authors show separation via IM writeprints. IM writeprints are shown to group messages belonging to a particular author from a set of authors and to group messages belonging to a particular author category from a set of author categories. By demonstrating high authorship identification and characterization probability, the research results presented in this dissertation indicate a promising future for applying authorship analysis as an element of a multimodal biometrics system to assist with cyber forensics and cybercrime investigations.