Forensic triage of email network narratives through visualisation

Information Management and Computer Security

Volumn 22, Issue 4, 2014, Pages 358-370

  Haggerty, John ^a   Haggerty, Sheryllynne ^b   Taylor, Mark ^c  

^a UNIVERSITY OF SALFORD   (United Kingdom)

^b UNIVERSITY OF NOTTINGHAM   (United Kingdom)

^c LIVERPOOL JOHN MOORES UNIVERSITY   (United Kingdom)

Author keywords

Data visualization; Digital forensics; Email; Narrative; Social network analysis

Indexed keywords

DATA VISUALIZATION; DIGITAL FORENSICS; ELECTRONIC CRIME COUNTERMEASURES; ELECTRONIC MAIL; FISHERIES; SOCIAL NETWORKING (ONLINE); VISUALIZATION;

DESIGN/METHODOLOGY/APPROACH; DIGITAL INVESTIGATION; ELECTRONIC EVIDENCES; ENRON EMAIL CORPORA; FORENSICS INVESTIGATIONS; NARRATIVE; NETWORK VISUALISATION; TOOLS AND TECHNIQUES;

COMPUTER FORENSICS;

EID: 84918569288     PISSN: 09685227     EISSN: None     Source Type: Journal    
DOI: 10.1108/IMCS-11-2013-0080     Document Type: Article

References (25)

1. Access Data (2013), "Access Data", available at: www.accessdata.com (accessed 30 October 2013).
2. BBC (2012) "Paedophile ring members jailed indefinitely" available at: www.bbc.co.uk/news/uk-england-19947914 (accessed 30 October 2013)
3. Chu, H.C., Deng, D.J. and Park, J.H. (2011), "Live data mining concerning social networking forensics based on a facebook session through aggregation of social data", IEEE Journal on Selected Areas in Communications, Vol. 29 No. 7, pp. 1368-1376.
4. DeBarr, D., Ramanathan, V. and Harry Wechsler, H. (2013), "Phishing detection using traffic behavior, spectral clustering and random forests", Proceedings of Intelligence and Security Informatics (ISI 2013) in Seattle, IEEE, Washington, DC, pp. 67-72.
5. Dou, W., Wang, X., Skau, D., Ribarsky, W. and Zhou, M.X. (2012), "LeadLine: interactive visual analysis of text data through event identification and exploration", Proceedings of the IEEE Symposium on Visual Analytics Science and Technology in Seattle, IEEE, Washington, DC, pp. 93-102.
6. EnronData.org (2014) "EnronData.org the enron data reconstruction project" available at: http://enrondata.org/content/data/(accessed 30 October 2013)
7. Esichaikul, V., Guha, S. and Juntapoln, C. (2011), "Monitoring email transaction logs by text-mining email contents", Proceedings of the 3rd International Conference on Data Mining and Intelligent Information Technology Applications (ICMiA), IEEE, Macao, pp. 255-258.
8. Fisher, D., Hoff, A., Robertson, G. and Hurst, M. (2008), "Narratives: a visualization to track narrative events as they develop", Proceedings of the IEEE Symposium on Visual Analytics Science and Technology, IEEE, Columbus, pp. 115-122.
9. Haggerty, J. and Haggerty, S. (2011), "Temporal social network analysis for historians: a case study", Proceedings of the International Conference on Visualization Theory and Applications (IVAPP 2011), Institute for Systems and Technologies of Information, Control and Communication, Algarve, pp. 207-217.
10. Haggerty, J., Karran, A.J., Lamb, D.J. and Taylor, M.J. (2011), "A framework for the forensic investigation of unstructured email relationship data", International Journal of Digital Crime and Forensics, Vol. 3 No. 3, pp. 1-18.
11. Hamid, I.R.A. and Abawajy, J. (2011), "Phishing email feature selection approach", Proceedings of the International Joint Conference of IEEE TrustCom-11, IEEE, Changsha, pp. 916-921.
12. Henseler, H. (2010), "Network-based filtering for large email collections in E-Discovery", Artificial Intelligence and Law, Vol. 18 No. 4, pp. 413-430.
13. Hullman, J. and Diakopoulos, N. (2011), "Visualization rhetoric: framing effects in narrative visualization", IEEE Transactions on Visualization and Computer Graphics, Vol. 17 No. 12, pp. 2231-2240.
14. Jankun-Kelly, T.J., Wilson, D., Stamps, A.S., Franck, J., Carver, J. and Swan, J.E. II (2009), "A visual analytic framework for exploring relationships in textual contents of digital forensics evidence", Proceedings of the 6th International Workshop on Visualization for Cyber Security, IEEE, Atlantic City, NJ, pp. 39-44.
15. Nair, V., Kaduskar, M., Bhaskaran, P., Bhaumik, S. and Lee, H. (2011), "Preserving narratives in electronic health records", Proceedings of the International Conference on Bioinformatics and Biomedicine, IEEE, Atlanta, pp. 418-421.
16. Osborne, G., Turnbull, B. and Slay, J. (2012), "Development of infovis software for digital forensics", Proceedings of the 36th International Conference on Software and Applications Workshop, IEEE, Izmir, pp. 213-217.
17. Palomo, E.J., North, J., Elizondo, D., Luque, R.M. and Watson, T. (2011), "Visualization of network forensics traffic data with self-organizing map for qualitative features", Proceedings of the International Joint Conference on Neural Networks, IEEE, San Jose, pp. 1740-1747.
18. Schrenk, G. and Poisel, R. (2011), "A discussion of visualization techniques for the analysis of digital evidence", Proceedings of the 6th International Conference on Availability, Reliability and Security, IEEE, Vienna, pp. 758-763.
19. Segel, E. and Heer, J. (2010), "Narrative visualization: telling stories with data", IEEE Transactions on Visualization and Computer Graphics, Vol. 16 No. 6, pp. 1139-1148.
20. Thomas, M. (2014), "What is the average reading speed and the best rate of reading?", available at: www.healthguidance.org/entry/13263/1/What-Is-the-Average-Reading-Speed-and-the- Best-Rate-of-Reading.html (accessed 30 October 2013).
21. Ungar, L., Leibholz, S. and Chaski, C. (2011), "IntentFinder: a system for discovering significant information implicit in large, heterogeneous document collections", Proceedings of the International Conference on Technologies for Homeland Security, IEEE, Waltham, pp. 219-223.
22. Wang, D., Liu, W., Xu, W. and Zhang, X. (2011), "Topic tracking based on event network", Proceedings of the International Conferences on Internet of Things, and Cyber, Physical and Social Computing, IEEE, Dalian, pp. 488-493.
23. Wiil, U.K., Gniadek, J. and Memon, N. (2010), "Measuring link importance in terrorist networks", Proceedings of the International Conference on Social Networks Analysis and Mining, Odense, pp. 225-232.
24. Yoshinaga, N., Itaya, S., Tanaka, R., Konishi, T., Doi, S., Yamada, K. and Davis, P. (2010), "Content propagation analysis of email communications", Proceedings of the 2010 IEEE/WIC/ACM International Conference on Web Intelligence and Intelligent Agent Technology, IEEE, WIC, ACM, Toronto, pp. 79-82.
25. Zilberman, P., Dolev, S., Katz, G., Elovici, Y. and Shabtai, A. (2013), "Analyzing group communication for preventing data leakage via email", Proceedings of Intelligence and Security Informatics 2013 in Seattle, IEEE, Washington, DC, pp. 37-41.